Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-30833 is a high-severity NoSQL injection vulnerability in Rocket.Chat's account service used by the ddp-streamer microservice. It occurs in the username-based login flow where user input is directly embedded into a MongoDB query without proper validation."}, {'type': 'paragraph', 'content': "An attacker can inject MongoDB operator expressions, such as { $regex: '.*' }, instead of a normal username string. This causes the database query to match unintended user records, potentially allowing unauthorized access."}, {'type': 'paragraph', 'content': 'The vulnerability arises because the username parameter is not sanitized before being used in the query, violating proper neutralization of special elements in data query logic (CWE-943).'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to manipulate login queries and potentially bypass normal username checks.

Attackers could log in without knowing valid usernames by injecting special MongoDB operators, which may lead to unauthorized access to user accounts.

If combined with related vulnerabilities, the impact could be more severe, increasing the risk of account compromise and unauthorized data access.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unusual or malformed login attempts to the Rocket.Chat websocket endpoint, specifically targeting the ddp-streamer microservice's login method."}, {'type': 'paragraph', 'content': "Since the injection occurs via the username parameter in MongoDB queries, detection involves looking for login requests where the username field contains MongoDB operator expressions such as {$regex: '.*'} instead of simple strings."}, {'type': 'paragraph', 'content': "You can inspect network traffic or logs for websocket messages sent to the <rocketchat-host>/websocket endpoint that invoke the 'login' server method with suspicious username payloads."}, {'type': 'list_item', 'content': 'Use network packet capture tools (e.g., tcpdump, Wireshark) to filter websocket traffic to the Rocket.Chat server and analyze login requests.'}, {'type': 'list_item', 'content': 'Search Rocket.Chat server logs for login attempts containing MongoDB operators in the username field.'}, {'type': 'list_item', 'content': 'Example command to check logs for suspicious usernames (assuming logs are in JSON format): grep -E \'\\{"username":\\{\\$regex\' /path/to/rocketchat/logs/*'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Rocket.Chat to one of the patched versions: 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, or 8.2.0.

If upgrading immediately is not possible, consider implementing input validation or filtering on the username parameter to ensure it is a primitive string and does not contain MongoDB operator expressions.

Additionally, monitor and restrict access to the Rocket.Chat websocket endpoint to trusted networks or authenticated users where feasible.

Review and apply any available patches or configuration changes recommended by Rocket.Chat security advisories.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0