Attack Chain

1. Attacker sends a forged password reset request to a target user via the Rocket.Chat API.
2. Attacker uses a blind NoSQL injection payload targeting the getPasswordPolicy method with the $regex operator to brute-force the password reset token character-by-character.
3. Attacker uses the discovered token to reset the target user's password.
4. Attacker repeats the process to compromise an administrator account.
5. Attacker authenticates as the administrator.
6. Attacker creates a new webhook integration and injects a JavaScript payload that utilizes child_process.exec() to spawn a reverse shell.
7. Attacker triggers the webhook, resulting in the execution of the reverse shell and full system compromise.

Impact

Successful exploitation results in full application compromise, including unauthorized access to sensitive user data, administrative control, and the ability to execute arbitrary system commands on the server hosting the Rocket.Chat instance.

Recommendation

1. Upgrade Rocket.Chat instances immediately to version 3.12.7 or later.
2. Identify and audit existing webhook integrations for unauthorized or suspicious JavaScript content.
3. Deploy web application firewall (WAF) rules to detect and block NoSQL injection patterns, specifically targeting requests to the getPasswordPolicy method containing $regex or other database operator syntax.
4. Hunt for evidence of unauthorized account password resets and newly created webhook integrations in application logs.