Apple Sign-In JWT Replay in Rocket.Chat

Executive Summary

This vulnerability exists in Rocket.Chat's Apple Sign-In handler prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The handler verifies JWT signatures but fails to validate the claims within the token. Specifically, any Apple-signed JWT with a non-empty issuer (iss) claim is accepted regardless of other important claims such as audience (aud), expiration time (exp), not before (nbf), or nonce.

An attacker who obtains a target user's Apple identity token—possibly from server logs, intercepted sign-in flows, or another application sharing the same Apple developer team—can replay this token to authenticate as that user. This replay attack has no expiration window, meaning the attacker can reuse the token indefinitely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to impersonate a legitimate user by replaying their Apple identity token without expiration. This can lead to unauthorized access to the user's account and potentially sensitive information within Rocket.Chat.

Because the attacker can authenticate as the user indefinitely, it poses a significant security risk including data exposure, unauthorized actions performed in the user's name, and potential compromise of communications.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to one of the fixed versions: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to replay stolen or intercepted Apple identity tokens to authenticate as any user without expiration limits on the replay window, leading to improper authentication and authentication bypass.

Such unauthorized access can compromise the confidentiality and integrity of user data, which may result in violations of data protection regulations like GDPR and HIPAA that require strict access controls and protection of personal and sensitive information.

Therefore, the vulnerability poses a risk to compliance with these standards by potentially enabling unauthorized data access and misuse.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper validation of Apple Sign-In JWT tokens in affected Rocket.Chat versions. Detection involves identifying usage of vulnerable Rocket.Chat versions and monitoring for replayed or suspicious Apple identity tokens.

To detect this vulnerability on your system, first verify the Rocket.Chat version in use. Versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13 are vulnerable.

• Check Rocket.Chat version by running: `snap info rocketchat-server` or inspecting the installed package version via your package manager.
• Search server logs for Apple identity tokens or JWTs used during authentication attempts to identify replayed tokens.
• Use network monitoring tools (e.g., tcpdump, Wireshark) to capture authentication traffic and analyze JWT tokens for suspicious reuse or tokens with non-empty 'iss' claims but missing or invalid 'aud', 'exp', 'nbf', or 'nonce' claims.
• Example command to capture traffic on port 3000 (default Rocket.Chat port): `sudo tcpdump -i any port 3000 -w rocketchat_auth.pcap`
• Decode captured JWT tokens using tools like `jwt-cli` or online JWT decoders to inspect claims for anomalies.

Useful 0 Not Useful 0