Executive Summary

This vulnerability exists in Rocket.Chat versions prior to 8.5.0 in the ImageElement component. The component renders user-controlled src values directly into <a href> and <img src> attributes without sanitizing the protocol. Unlike a similar component that blocks dangerous protocols like javascript:, data:, and vbscript:, ImageElement allows raw URLs to pass through unchanged.

An authenticated user can post a markdown image with a javascript: URL. If another user clicks on this image link using an older browser, arbitrary JavaScript code could execute in the viewer's session, potentially compromising their security.

This issue was fixed in Rocket.Chat version 8.5.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to the execution of arbitrary JavaScript code in the session of a user who clicks on a malicious image link posted by an authenticated user. This could result in session hijacking, data theft, or other malicious actions performed within the context of the affected user's session.

Because the attack requires user interaction (clicking the malicious image) and an older browser, the risk is somewhat limited but still significant, especially in environments where users may not be aware of the threat.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to version 8.5.0 or later, where the issue with the ImageElement component rendering user-controlled src values without protocol sanitization has been fixed.

Until the upgrade is applied, restrict authenticated users from posting markdown images with potentially dangerous javascript: URLs to prevent arbitrary JavaScript execution in viewers' sessions.

Useful 0 Not Useful 0