Rocket.Chat · Report #1014459
Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)
Validstatus
highseverity
24upvotes
25 Mar 2021disclosed
Summary
Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.