Arbitrary file read in Rocket.Chat-Desktop

How it was found

Description: Rocket.Chat-Desktop is vulnerable to arbitrary file read.

Releases Affected:

• Rocket.Chat-Desktop-Client: < v3.0.0-develop

Steps To Reproduce (by setting up a malicious server):

1. Go to Administration » Layout » Custom Scripts » Custom Script for Logged In Users
2. Insert the following script window.open('file://c:/windows/system32/drivers/etc/hosts').eval('alert(document.body.innerText);');
3. Click Save changes
4. Open Rocket.Chat-Desktop and connect to the server
5. A new window and an alert containing the contents of c:/windows/system32/drivers/etc/hosts will pop up.

Suggested mitigation

• Set popups to false [src » component » electron » WebViewComponent.js (line 16)].

Impact

Arbitrary file read in Rocket.Chat-Desktop