Rocket.Chat · Report #2546437
The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.
Validstatus
highseverity
23upvotes
1 Oct 2024disclosed
Summary
The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate time and resources.
Special thanks to Hayato Kimura, Ryoma Ito, Kazuhiko Minematsu, and Takanori Isobe for their research.
This insufficient entropy in the initinal E2EE password was caused by the bias in the E2EE password generation process.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.