CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...

Rocket.Chat: NoSQL injection leaks visitor token and livechat messages

The Rocket.Chat application was affected by two NoSQL injection vulnerabilities. The first vulnerability allowed leaking visitor tokens by exploiting the livechat:loginByToken method, while the second vulnerability enabled leaking livechat messages by exploiting the livechat:loadHistory method...