Executive Summary

This vulnerability exists in Rocket.Chat's CAS login handler prior to certain fixed versions. The handler forwards a client-supplied credential token directly into a MongoDB query without checking its type at runtime. Because TypeScript's type annotations are erased at runtime, an attacker can replace the expected token string with a MongoDB query operator (like "$gt" or "$ne"). This causes the query to match the first unexpired credential token document, bypassing the CAS ticket verification.

When a legitimate CAS or SAML SSO login is in progress, the attacker can then use this bypass to obtain a full authentication token for the victim user. This token grants access to the REST and DDP interfaces as that user. If the victim is an administrator, the attacker can fully compromise the instance, including installing apps via the Apps-Engine.

The vulnerability is fixed in Rocket.Chat versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an unauthenticated attacker to bypass authentication and gain full access to a victim user's account on Rocket.Chat.

• The attacker can obtain a Meteor authentication token for the victim user.
• The attacker can access all REST and DDP interfaces as the victim user.
• If the victim user is an administrator, the attacker can fully compromise the Rocket.Chat instance, including installing malicious apps.

Overall, this leads to unauthorized access, potential data exposure, and full system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to one of the fixed versions: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11.

Useful 0 Not Useful 0