Executive Summary

This vulnerability exists in Rocket.Chat's Apple Sign-In handler prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The handler verifies JWT signatures but fails to validate the claims within the token. Specifically, any Apple-signed JWT with a non-empty issuer (iss) claim is accepted regardless of other important claims such as audience (aud), expiration time (exp), not before (nbf), or nonce.

An attacker who obtains a target user's Apple identity token—possibly from server logs, intercepted sign-in flows, or another application sharing the same Apple developer team—can replay this token to authenticate as that user. This replay attack has no expiration window, meaning the attacker can reuse the token indefinitely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to impersonate a legitimate user by replaying their Apple identity token without expiration. This can lead to unauthorized access to the user's account and potentially sensitive information within Rocket.Chat.

Because the attacker can authenticate as the user indefinitely, it poses a significant security risk including data exposure, unauthorized actions performed in the user's name, and potential compromise of communications.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Rocket.Chat to one of the fixed versions: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13.

Useful 0 Not Useful 0