Vulnerability in Rocket.chat
CVE-2021-22911
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
EPSS: 0.952 (99.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Rocket.chat — versions 3.11.0, 3.12.0, 3.13.0
- N/a Rocket.chat Server — versions Fixed in: 3.13.2, 3.12.4, 3.11.4
Weakness classification (CWE)
Public proof-of-concept exploits
- CsEnox/CVE-2021-22911
- optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911
- Faridi-m/CVE-2021-22911-RocketChat
- roshanrajbanshi/rocketcat-cve-2021-22911-exploit
- TeneBrae93/RocketChat-NoSQLi-Chain-CVE-2021-22911
- octodi/CVE-2021-22911
- yoohhuu/Rocket-Chat-3.12.1-PoC-CVE-2021-22911-
- overgrowncarrot1/CVE-2021-22911
- MrDottt/CVE-2021-22911
- ChrisPritchard/CVE-2021-22911-rust
References
- support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC)
- support@hackerone.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- support@hackerone.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-22911?
- CVE-2021-22911 is a critical-severity vulnerability in Rocket.chat, classified under CWE-75. CVSS score: 9.8/10. Published 2021-05-27.
- How severe is CVE-2021-22911?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2021-22911 known to be exploited?
- 37 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.