667 matches found
Rocket.Chat: Rocket.chat user info security issue
Hello, We have find potential security issue that user with “view-full-other-user-info” permissions is able to view another user's OAuth tokens via Rest API. Tested on Rocket.Chat version 4.3.3 Steps to reproduce: 1. Integration with OAuth 2.0 identity provider e.g. Keycloak is required 1. Add ro...
Rocket.Chat: Maliciously crafted message can cause Rocket.Chat server to stop responding
Vulnerability description not provided...
Rocket.Chat: Authentication Bypass in login-token Authentication Method
The Rocket.Chat application contained a vulnerability in the login-token authentication method that allowed for authentication bypass. Improper input data validation in the login-token authentication handler permitted the use of crafted data to obtain a valid authToken, granting administrative...
Rocket.Chat: getRoomRoles Method leaks Channel Owner
Summary Lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Description Lack of ACL checks in the getRoomRoles Meteor method allow unauthorized clients to query channel members with special roles: javascript Meteor.methods...
Rocket.Chat: Mute User can disclose private channel members to unauthorized users
Vulnerability description not provided...
Vulnerability Research Highlights 2021
At SonarSource we are constantly improving our code analyzers to help developers write Clean Code. The detection of severe code vulnerabilities plays an important role in this process so that applications are protected from attacks and security breaches. For this same reason, our research team...
Rocket.Chat: getUserMentionsByChannel leaks messages with mention from private channel
Summary The getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Description When calling the getUserMentionsByChannel method, the server does not check the users access to the given room...
Rocket.Chat: Moving private messages into vision with updateMessage method
Vulnerability description not provided...
Rocket.Chat: Persistent CSS injection with ’marked’ markdown parser in Rocket.Chat
Summary: Rocket.Chat offers two different markdown parsers out of the box: the ’orginal’ one and the ’marked’ one. Both markdown parsers offer a different set of features with different re- strictions. Due to more loose restrictions in the ’marked’ parser, a persistent CSS injection in the web...
Rocket.Chat: Unintended information disclosure in the Hubot Log files
Dear Rocket.Chat Team While inspecting our logs I noticed, that the OAuth Tokens are leaked in plaintext in the logs. I wanted to draw your attention to this, as this is a security vulnerability. See the attached Screenshot for a redacted log excerpt. In my opinion, the best approach here would b...
Rocket.Chat: Content-Security Policy bypass with File Uploads
The default Content-Security Policy CSP in Rocket.Chat versions 4.0.3 and 3.18.2 was bypassed by uploading a JavaScript file through the file upload feature. This file could then be included in the web application, allowing the execution of arbitrary scripts...
Rocket.Chat: Retrospective change of message timestamp and order
Vulnerability description not provided...
Rocket.Chat: Messages can be hidden regardless of server configuration
Vulnerability description not provided...
Rocket.Chat: XSS in various MessageTypes
The Rocket.Chat vulnerability allowed arbitrary script execution in the receiving frontend client through the rendering of messages of various MessageTypes. The vulnerability affected versions 3.18.2 and 4.0.3. The issue was caused by the lack of sanitization of message parameters rendered from...
CVE-2020-8291
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks...
CVE-2020-8291
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks...
Cross site scripting
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks...
CVE-2020-8291
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks...
CVE-2020-8291
The CVE-2020-8291 entry concerns Rocket.Chat’s link-preview rendering, with a vulnerability present in versions before 3.9 that could enable cross‑site scripting (XSS). Affected component: the link-preview rendering code; root cause: improper handling during preview generation allows injected scr...
