PT-2023-19298 · Unknown · Rocket.Chat

Yuske · Publicado 2023-02-23 · Atualizado 2023-03-03 · CVE-2023-23917

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat server versions prior to 5.2.0

Description A prototype pollution issue exists that could allow an attacker to achieve remote code execution (RCE) under the admin account. This vulnerability may affect cloud infrastructure, as any user can create their own server and become an admin. Additionally, it may increase the impact of cross-site scripting (XSS) to RCE, posing a risk to self-hosted users.

Recommendations For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to admin accounts and monitoring for suspicious activity.

Correção

RCE

Prototype Pollution

Command Injection

Enumeração de Fraquezas

CWE-1321

CWE-77

Identificadores relacionados

CVE-2023-23917

Produtos afetados

Rocket.Chat

Referências · 5

• https://hackerone.com/reports/1631258 · Nota
• https://osv.dev/vulnerability/CVE-2023-23917 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23917 · Nota
• https://t.me/cibsecurity/58816 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23917 · Nota de Segurança