Browse / Rocket.Chat

Rocket.Chat

See its reports on the map

What gets reported to Rocket.Chat

• Information Disclosure17
• Cross-site Scripting16
• Access Control14
• Code Execution11
• Authentication9
• SQL Injection7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Complete authentication bypass to admin permissionsSQL Injection · critical
   100 votes
2. Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChatCross-site Scripting (XSS) - Stored · medium
   97 votes
3. IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message IDInsecure Direct Object Reference (IDOR) · low
   86 votes
4. Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access CheckInsecure Direct Object Reference (IDOR) · high
   74 votes
5. XSS via /api/v1/chat.postMessage Cross-site Scripting (XSS) - Stored · critical
   73 votes
6. account takeover on 3.0.1 versionInsecure Direct Object Reference (IDOR) · critical
   65 votes
7. Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.comSQL Injection
   61 votes
8. Guest Privilege Escalation to admin groupImproper Access Control - Generic · critical
   59 votes
9. Unauthenticated full-read SSRF via Twilio integrationServer-Side Request Forgery (SSRF) · high
   52 votes
10. Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()Improper Access Control - Generic · critical
    49 votes
11. Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storagePath Traversal · high
    47 votes
12. Upload of Avatars for other UsersImproper Access Control - Generic · medium
    47 votes
13. IDOR: autotranslate.translateMessage Full Message Content LeakInsecure Direct Object Reference (IDOR) · medium
    43 votes
14. Account takeover via XSSCross-site Scripting (XSS) - Stored · critical
    41 votes
15. RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logsImproper Access Control - Generic · medium
    40 votes
16. Remote Code Execution in Rocket.Chat-DesktopCode Injection · critical
    40 votes
17. Authentication Bypass via XML Signature Wrapping in SAML SSOImproper Authentication - Generic · critical
    39 votes
18. Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.Code Injection · medium
    35 votes
19. Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded fileImproper Authentication - Generic · high
    34 votes
20. Online Status of arbitrary users can be changedImproper Access Control - Generic · medium
    33 votes
21. Open Redirect in Rocket.ChatOpen Redirect · medium
    32 votes
22. Authentication Bypass in login-token Authentication MethodImproper Authentication - Generic · critical
    31 votes
23. XSS leads to RCE on the RocketChat desktop client.OS Command Injection · critical
    31 votes
24. NoSQL injection leaks visitor token and livechat messagesInformation Disclosure · medium
    29 votes
25. Registration bypass with leaked Invite TokenImproper Authentication - Generic · high
    29 votes
26. Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)Server-Side Request Forgery (SSRF) · high
    28 votes
27. SSRF via improper validation after DNS name resolution in the link-preview featureServer-Side Request Forgery (SSRF) · high
    27 votes
28. [Security Vulnerability Rocket.chat] HTML Injection into Email via SignupCode Injection · medium
    27 votes
29. SSRF via Improper Redirect Validation in Rocket.Chat oEmbed FunctionServer-Side Request Forgery (SSRF) · medium
    25 votes
30. Bypassing 2FA with conventional session management - open.rocket.chatImproper Authentication - Generic · low
    25 votes
31. Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)Cross-site Scripting (XSS) - DOM · high
    24 votes
32. The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.Use of Insufficiently Random Values · high
    23 votes
33. Rocket.Chat Server RCECommand Injection - Generic · critical
    21 votes
34. Clickjacking in the admin pageUI Redressing (Clickjacking) · low
    21 votes
35. Pre-Auth Blind NoSQL Injection leading to Remote Code ExecutionSQL Injection · critical
    20 votes
36. Low authorization level at server side API operation e2e.updateGroupKey, let an attacker break the E2E architecture.Improper Access Control - Generic · high
    19 votes
37. CSS Injection in Message AvatarCode Injection · medium
    19 votes
38. Blind XSS in the rocket.chat registration emailCross-site Scripting (XSS) - Stored
    18 votes
39. Unread Messages can leak Message IDsInformation Disclosure · medium
    17 votes
40. Desktop app RCE (#276031 bypass)Code Injection · high
    17 votes
41. DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)NoSQL Injection · high
    16 votes
42. Clickjacking at open.rocket.chatUI Redressing (Clickjacking) · medium
    16 votes
43. XSS in message attachment fileds.Cross-site Scripting (XSS) - Stored · critical
    16 votes
44. Stored HTML Injection (CWE-79) via Livechat Visitor NameCross-site Scripting (XSS) - DOM · low
    15 votes
45. SAML authentication bypassImproper Authentication - Generic · high
    15 votes
46. Content-Security Policy bypass with File UploadsImproper Access Control - Generic · high
    14 votes
47. Arbitrary file read in Rocket.Chat-DesktopPath Traversal · medium
    14 votes
48. Slack Token exposed over internet (Github)Cleartext Storage of Sensitive Information
    14 votes
49. Post-Auth Blind NoSQL Injection in the users.list API leads to Remote Code ExecutionSQL Injection · high
    13 votes
50. Unauthenticated clients can modify Livechat Business HoursImproper Access Control - Generic · medium
    13 votes
51. Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCEOS Command Injection · critical
    13 votes
52. API Keys Hardcoded in Github repositoryUse of Hard-coded Credentials · medium
    13 votes
53. Remote Code Execution in Rocket.Chat DesktopCode Injection · high
    13 votes
54. XSS in various MessageTypesCross-site Scripting (XSS) - Stored · high
    12 votes
55. Blind XSSCross-site Scripting (XSS) - Generic · low
    12 votes
56. Hi! Security Team Rocket.Chat, It's possible to get information about the users emails without authenticationInformation Disclosure · low
    12 votes
57. Rocket.Chat Desktop client fails to open browser on 3rd party external actions from PDF documentsCleartext Transmission of Sensitive Information · low
    11 votes
58. NoSQL injection in listEmojiCustom method callSQL Injection · high
    11 votes
59. Improper ACL in Message StarringImproper Access Control - Generic · medium
    11 votes
60. Session Hijack via Self-XSSCross-site Scripting (XSS) - DOM · medium
    11 votes
61. XSS (leads to arbitrary file read in Rocket.Chat-Desktop)Cross-site Scripting (XSS) - Stored · low
    11 votes
62. Open redirect open.rocket.chat/file-upload/ID/filename.svgOpen Redirect · medium
    11 votes
63. Moving private messages into vision with updateMessage methodInformation Disclosure · high
    10 votes
64. Regex account takeoverSQL Injection · critical
    9 votes
65. Possible Domain Takeover on AWS Instance.Phishing · low
    9 votes
66. Broken access control on apps Improper Access Control - Generic · critical
    9 votes
67. TOTP 2 Factor Authentication BypassImproper Authentication - Generic · high
    8 votes
68. Pinning leaks message contentInformation Disclosure · high
    8 votes
69. Reflected Cross-Site Scripting(CVE-2022-32770 )Cross-site Scripting (XSS) - Reflected · high
    7 votes
70. Impersonation in Sequential Messagesmedium
    7 votes
71. XSS (stored) Wizard is saving executable codeCross-site Scripting (XSS) - Stored · medium
    7 votes
72. Mute User can disclose private channel members to unauthorized usersInformation Disclosure · medium
    6 votes
73. Bypass local authentication (PIN code)Improper Authentication - Generic · medium
    6 votes
74. Improper Access Control - GenericImproper Access Control - Generic · low
    6 votes
75. Cross-Site-Scripting in "Search Messages"Cross-site Scripting (XSS) - Stored · medium
    5 votes
76. Messages can be hidden regardless of server configurationmedium
    5 votes
77. Post-Auth Stored XSS with User Interaction leads to Remote Code ExecutionCross-site Scripting (XSS) - Stored · high
    5 votes
78. SAML authentication bypass through unauthenticated `addSamlProvider` Meteor CallImproper Access Control - Generic · critical
    5 votes
79. User Impersonation through sendMessage optionsUI Redressing (Clickjacking) · medium
    5 votes
80. Custom crafted message object in Meteor.Call allows remote code execution and impersonationCode Injection · critical
    5 votes
81. Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-DesktopOS Command Injection · high
    4 votes
82. API route chat.getThreadsList leaks private message contentInformation Disclosure · high
    4 votes
83. Persistent CSS injection with ’marked’ markdown parser in Rocket.ChatCross-site Scripting (XSS) - Stored · high
    4 votes
84. Maliciously crafted message can cause Rocket.Chat server to stop respondingUncontrolled Resource Consumption · medium
    3 votes
85. NoSQL-Injection discloses S3 File Upload URLsInformation Disclosure · medium
    3 votes
86. getUserMentionsByChannel leaks messages with mention from private channelInformation Disclosure · high
    3 votes
87. Retrospective change of message timestamp and orderUncontrolled Resource Consumption · medium
    3 votes
88. REST API gets `query` as parameter and executes itInformation Disclosure · medium
    3 votes
89. It is possible to elevate privileges for any authenticated user to view permissions matrix and view Direct messages without appropriate permissions.Privilege Escalation · medium
    3 votes
90. Rocket.chat user info security issueCleartext Transmission of Sensitive Information · medium
    2 votes
91. getRoomRoles Method leaks Channel OwnerInformation Disclosure · medium
    2 votes
92. getUsersOfRoom discloses users in private channelsImproper Access Control - Generic · medium
    2 votes
93. Message ID Enumeration with Action Link HandlerInformation Disclosure · medium
    2 votes
94. Unintended information disclosure in the Hubot Log filesCleartext Storage of Sensitive Information · medium
    1 votes
95. Message ID Enumeration with Regular Expression in getReadReceipts Meteor methodInformation Disclosure · medium
    1 votes