PT-2021-15268 · Unknown · Rocket.Chat

Sonarsource · Published 2021-05-27 · Updated 2022-08-31 · CVE-2021-22911

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat server versions 3.11 through 3.13

Description A vulnerability exists due to improper input sanitization, potentially leading to unauthenticated NoSQL injection and resulting in remote code execution (RCE).

Recommendations For Rocket.Chat server versions 3.11 through 3.13, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-75

Related Identifiers

CVE-2021-22911

Affected Products

Rocket.Chat

References · 14

• 🔥 https://github.com/CsEnox/CVE-2021-22911 · Exploit
• 🔥 https://github.com/optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911 · Exploit
• 🔥 http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50108 · Exploit
• 🔥 https://exploit-db.com/exploits/49960 · Exploit
• 🔥 https://blog.sonarsource.com/nosql-injections-in-rocket-chat · Exploit
• 🔥 https://hackerone.com/reports/1130721 · Exploit
• https://osv.dev/vulnerability/CVE-2021-22911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22911 · Security Note
• https://github.com/zon8research/v8-vulnerabilities · Note
• https://t.me/cybersecuritytechnologies/3553 · Telegram Post
• https://t.me/cvenotify/15721 · Telegram Post
• https://t.me/cvenotify/35486 · Telegram Post