Rocket.Chat Pre-Auth NoSQL Injection in CAS Login Handler Analysis

Vulnerability Overview The CAS login handler in Rocket.Chat contains a pre-authentication NoSQL injection vulnerability, leading to arbitrary CAS/SAML user session hijacking. Attackers can bypass CAS token checks by replacing MongoDB query operators (such as ), thereby gaining access to non-expired documents. Affected Versions Affected Versions: Rocket.Chat <8.5.0, <8.4.1, <8.3.3, <8.2.3, 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, <8.1.4, <8.0.5, <7.13.7, 8.0.5, 7.13.7, 7.10.11, <7.10.11 Severity: Critical (9.1/10) CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Remediation Fixed Versions: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11 Vulnerability Details Prerequisites No authentication required; attackers only need network access to the instance's or endpoints. The target instance must be configured and actively using CAS or SAML. Legitimate SSO login must occur within the 60-second credential token window. Root Cause 1. Lack of type validation in the CAS handler: 2. Raw query composition in the model: 3. Unconditional registration of the CAS handler at startup: 4. Cross-provider attack surface via writing to the same collection by SAML: 5. Short but deterministic race condition window: Impact Full account takeover: Any user performing CAS or SAML SSO login can be hijacked by an attacker. Privilege escalation to administrator: If the victim is an administrator, the attacker can install arbitrary Apps-Engine applications, modify settings, and view all user data. Cross-provider blast radius: SAML instances can also be exploited because the CAS handler reads from the collection written to by SAML. No authentication, no account, no user interaction: Attackers only need network access to the instance's . Stealthy against victims: The victim's CAS login completes normally. Although the server-level DDP access log records an additional method call, Rocket.Chat does not log DDP method bodies. Additional Information CVE ID: CVE-2024-4588 Weakness: CWE-943 Credit: odd

Goal Reached Thanks to every supporter — we hit 100%!

Rocket.Chat Pre-Auth NoSQL Injection in CAS Login Handler Analysis

More from this source