Session Fixation in Rocket.Chat

Executive Summary

This vulnerability affects Rocket.Chat versions prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. It allows users who have been deactivated due to idleness through the users.deactivateIdle feature to continue using their previously issued login tokens. Essentially, even after an administrator marks a user as inactive for being idle, that user can still access authenticated REST endpoints using their old token.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that deactivated users can still access the system with their old login tokens, potentially allowing unauthorized access to authenticated REST endpoints. This could lead to unauthorized actions or data exposure by users who should no longer have access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to one of the fixed versions: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows deactivated users to continue accessing authenticated REST endpoints using previously issued login tokens, which means that user access is not properly revoked upon deactivation.

Such unauthorized continued access could potentially lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict control over user access and timely revocation of credentials to protect personal and sensitive data.

However, the provided information does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves deactivated users retaining access via already-issued login tokens, allowing continued access to authenticated REST endpoints.

To detect this on your system, you can monitor API access logs for requests authenticated with tokens belonging to users marked as inactive or idle.

Specifically, you can query your Rocket.Chat user database or API to identify users flagged as inactive through users.deactivateIdle and then cross-reference active API tokens associated with those users.

• Check for users marked inactive but still having valid login tokens.
• Inspect API access logs for token usage by inactive users.

Example commands might include querying the Rocket.Chat database or API for inactive users and their tokens, such as:

• Using MongoDB shell to find inactive users: db.users.find({active: false})
• Checking tokens associated with these users if stored in the database.

Additionally, monitoring HTTP access logs for REST API calls authenticated with tokens from inactive users can help detect exploitation.

Useful 0 Not Useful 0