PT-2023-19298 · Unknown · Rocket.Chat

Yuske · Published 2023-02-23 · Updated 2023-03-03 · CVE-2023-23917

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat server versions prior to 5.2.0

Description A prototype pollution issue exists that could allow an attacker to achieve remote code execution (RCE) under the admin account. This vulnerability may affect cloud infrastructure, as any user can create their own server and become an admin. Additionally, it may increase the impact of cross-site scripting (XSS) to RCE, posing a risk to self-hosted users.

Recommendations For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to admin accounts and monitoring for suspicious activity.

Fix

RCE

Prototype Pollution

Command Injection

Weakness Enumeration

CWE-1321

CWE-77

Related Identifiers

CVE-2023-23917

Affected Products

Rocket.Chat

References · 5

• https://osv.dev/vulnerability/CVE-2023-23917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23917 · Security Note
• https://hackerone.com/reports/1631258 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23917 · Note
• https://t.me/cibsecurity/58816 · Telegram Post