Rocket.Chat Authenticated Arbitrary Data Export via sendFileMessage DDP Method

Vulnerability Overview The DDP method in Rocket.Chat contains an authentication bypass vulnerability allowing arbitrary data exfiltration. An attacker can control the object, causing it to be directly merged into the MongoDB operation. This allows overwriting any column, including the and fields. By leveraging cloud storage backends such as Google Cloud Storage or Amazon S3, an attacker can generate a signed URL pointing to a target user's data export, resulting in data leakage. Impact Scope Affected Versions: Rocket.Chat <8.5.0, <8.4.1, <8.3.3, <8.2.3, 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, <8.1.4, <8.0.5, <7.13.7, 8.0.5, 7.13.7, 7.10.11, <7.10.11 Fixed Versions: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11 CVSS Score: 8.5/10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: Low Availability: Low Remediation 1. Unfiltered Code Path: - In the method, the object is directly merged into the operation without field restrictions. - Fix: Add field restrictions to the operation to prevent the object from being directly merged. 2. Blind Merge into : - merges the object into , resulting in the object being updated with attacker-controlled values. - Fix: Validate the object before using to ensure it is not merged directly. 3. Attacker-Controlled Cloud Storage Path: - Cloud storage backends (GCS, S3, WebDAV) read paths directly from the object, allowing attackers to control the path. - Fix: Validate the legality of the path before reading it to prevent attacker-controlled paths. 4. Predictable Path: - The path is predictable, allowing attackers to generate signed URLs. - Fix: Add randomness when generating signed URLs to prevent path prediction. 5. Authorization Bypass via Store-Swap: - Attackers can bypass authorization checks by controlling the field within the object. - Fix: Validate the field during authorization checks to prevent bypass. POC Code The code above illustrates the critical parts of the vulnerability. An attacker can control the object to generate a signed URL pointing to a target user's data export, leading to data leakage.

Goal Reached Thanks to every supporter — we hit 100%!

Rocket.Chat Authenticated Arbitrary Data Export via sendFileMessage DDP Method

More from this source