Account Takeover via Apple OAuth JWT in Rocket.Chat

Executive Summary

This vulnerability exists in Rocket.Chat versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13 in the Apple OAuth login handler.

The issue is in the handleIdentityToken function that parses a JWT issued by Apple during the OAuth flow. The code expects the JWT to contain an email parameter.

If the JWT does not contain an email address, the application incorrectly falls back to accepting an arbitrary email value supplied directly in the request.

Attackers can exploit this by forging Apple JWTs without an email address and supplying arbitrary email values, allowing them to carry out account takeover attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account takeover attacks.

An attacker can forge Apple JWTs without an email and supply arbitrary email addresses to gain unauthorized access to user accounts.

This compromises the security and privacy of user accounts on the affected Rocket.Chat instances.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to one of the fixed versions: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to carry out account takeover attacks by exploiting improper authentication in Rocket.Chat's Apple OAuth flow. Such unauthorized access to user accounts can lead to exposure or misuse of personal and sensitive information.

This kind of security flaw can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strong access controls and protection of personal data to prevent unauthorized access and data breaches.

However, the provided information does not explicitly describe the direct effects on compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the improper handling of the email parameter during Apple OAuth authentication in Rocket.Chat. Detection would focus on identifying OAuth requests where the JWT token from Apple lacks an email field but an arbitrary email is accepted.

To detect potential exploitation attempts on your system or network, you can monitor and analyze OAuth login requests to Rocket.Chat for suspicious patterns such as JWT tokens missing the email claim or unusual email values supplied directly in the request.

Suggested commands for detection might include:

• Using network traffic analysis tools (e.g., tcpdump, Wireshark) to capture HTTP POST requests to the OAuth login endpoint and inspect the JWT payload for missing email claims.
• Using command-line tools like `jq` to parse logs or captured requests for OAuth tokens missing the email field.
• Example command to extract and decode JWT tokens from logs (assuming logs contain the token):
• cat access.log | grep 'loginHandler' | grep 'apple' | awk '{print $NF}' | cut -d'.' -f2 | base64 -d | jq '.'

Note: The exact commands depend on your logging setup and how OAuth requests are recorded. Monitoring for login attempts with JWT tokens lacking an email claim or with arbitrary email parameters supplied directly can help detect exploitation attempts.

Useful 0 Not Useful 0