667 matches found
Rocket.Chat: Custom crafted message object in Meteor.Call allows remote code execution and impersonation
The researcher found a vulnerability where an attacker could impersonate other users...
Rocket.Chat: Upload of Avatars for other Users
The vulnerability allowed unprivileged users to upload avatar pictures on behalf of other users. The effect of the exploit depended on the storage backend, with the default GridFS being affected. The vulnerability was found in the Rocket.Chat development version at commit 5f0180dc...
Rocket.Chat: Online Status of arbitrary users can be changed
A vulnerability was discovered in a third-party Meteor module, Konecty/meteor-user-presence, that allowed the online status of arbitrary users to be changed without proper authentication. This was possible by sending crafted HTTP requests or WebSocket data with specific payloads. The issue was...
Rocket.Chat: Broken access control on apps
Summary: The user without administrative privileges can upload and install any Application into the rocket.chat As ID of application is controlled in the app.json file which is controlled by uploader user can also activate the app. Releases Affected: 0.73.2 Steps To Reproduce: - User log-in into...
Rocket.Chat: Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.
Hi team, When I downloaded the latest release of Rocket.Chat to test the fix for my previous report I spotted an install.sh script. Inside that installation script I noticed the following line: diff !/bin/bash set -x set -euvo pipefail IFS=$'\n\t' ROOTPATH=/var/www/rocket.chat PM2FILE=pm2.json if...
Rocket.Chat: XSS (stored) Wizard is saving executable code
issue: xssstored Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The stored input is not correctly filtered. As a consequence, the malicious data will appear to be part of the web site and run...
Rocket.Chat: Blind XSS in the rocket.chat registration email
Note: This report was initially sent via email and I was invited to submit this here. Hi team, During an audit on a third-party, I discovered that rocket.chat Android client might be vulnerable to blind XSS. My XSS payload fired in the context of the target's rocket.chat client as you can see bel...
CVE-2018-13878
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...
CVE-2018-13879
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via...
CVE-2018-13879
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via...
CVE-2018-13878
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...
Cross site scripting
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...
Cross site scripting
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via...
CVE-2018-13879
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via...
CVE-2018-13879
CVE-2018-13879 describes a reflected XSS in Rocket.Chat’s registration flow prior to 0.66. During account creation, the next step asks for a username; the input may cause an error message that displays the attempted username unescaped, via the code paths in packages/rocketchat-ui-login/client/use...
CVE-2018-13878
Rocket.Chat (Mentions.js) up to version 0.65 is affected by an XSS in which the real name of a mentioned user is displayed unescaped in channels or private chats, enabling potential exfiltration of tokens for users and admins. The issue is tied to the packages/rocketchat-mentions/Mentions.js path...
CVE-2018-13878
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...
Sql injection
Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover...