Rocket.Chat: Unauthenticated NoSQL Injection and Remote Code Execution (CVE-2021-22911)

CVE-2021-22911 is a critical vulnerability affecting Rocket.Chat versions prior to 3.12.7. The vulnerability resides in the NoSQL database queries used for password resets. An unauthenticated attacker can exploit this via blind NoSQL injection to extract password reset tokens for any user, including administrators. Successful exploitation leads to administrative account takeover and subsequent remote code execution (RCE) by leveraging the application's webhook feature to run arbitrary JavaScript payloads within the Node.js runtime environment. Public exploit code is now available, significantly increasing exploitation risk.

Attack Chain

1. Attacker sends a forged password reset request to a target user via the Rocket.Chat API.
2. Attacker uses a blind NoSQL injection payload targeting the getPasswordPolicy method with the $regex operator to brute-force the password reset token character-by-character.
3. Attacker uses the discovered token to reset the target user's password.
4. Attacker repeats the process to compromise an administrator account.
5. Attacker authenticates as the administrator.
6. Attacker creates a new webhook integration and injects a JavaScript payload that utilizes child_process.exec() to spawn a reverse shell.
7. Attacker triggers the webhook, resulting in the execution of the reverse shell and full system compromise.

Impact

Successful exploitation results in full application compromise, including unauthorized access to sensitive user data, administrative control, and the ability to execute arbitrary system commands on the server hosting the Rocket.Chat instance.

Recommendation

1. Upgrade Rocket.Chat instances immediately to version 3.12.7 or later.
2. Identify and audit existing webhook integrations for unauthorized or suspicious JavaScript content.
3. Deploy web application firewall (WAF) rules to detect and block NoSQL injection patterns, specifically targeting requests to the getPasswordPolicy method containing $regex or other database operator syntax.
4. Hunt for evidence of unauthorized account password resets and newly created webhook integrations in application logs.