{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arocket.chatrocket.chat3.13.0-/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*","cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:-:*:*:*:*:*:*","cpe:2.3:a:rocket.chat:rocket.chat:3.12.0:-:*:*:*:*:*:*","cpe:2.3:a:rocket.chat:rocket.chat:3.13.0:-:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2021-22911"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rocket.Chat (\u003c 3.12.7)"],"_cs_severities":["critical"],"_cs_tags":["rocket-chat","nosql-injection","rce","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Rocket.Chat"],"content_html":"\u003cp\u003eCVE-2021-22911 is a critical vulnerability affecting Rocket.Chat versions prior to 3.12.7. The vulnerability resides in the NoSQL database queries used for password resets. An unauthenticated attacker can exploit this via blind NoSQL injection to extract password reset tokens for any user, including administrators. Successful exploitation leads to administrative account takeover and subsequent remote code execution (RCE) by leveraging the application's webhook feature to run arbitrary JavaScript payloads within the Node.js runtime environment. Public exploit code is now available, significantly increasing exploitation risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a forged password reset request to a target user via the Rocket.Chat API.\u003c/li\u003e\n\u003cli\u003eAttacker uses a blind NoSQL injection payload targeting the \u003ccode\u003egetPasswordPolicy\u003c/code\u003e method with the \u003ccode\u003e$regex\u003c/code\u003e operator to brute-force the password reset token character-by-character.\u003c/li\u003e\n\u003cli\u003eAttacker uses the discovered token to reset the target user's password.\u003c/li\u003e\n\u003cli\u003eAttacker repeats the process to compromise an administrator account.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates as the administrator.\u003c/li\u003e\n\u003cli\u003eAttacker creates a new webhook integration and injects a JavaScript payload that utilizes \u003ccode\u003echild_process.exec()\u003c/code\u003e to spawn a reverse shell.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the webhook, resulting in the execution of the reverse shell and full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full application compromise, including unauthorized access to sensitive user data, administrative control, and the ability to execute arbitrary system commands on the server hosting the Rocket.Chat instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Rocket.Chat instances immediately to version 3.12.7 or later.\u003c/li\u003e\n\u003cli\u003eIdentify and audit existing webhook integrations for unauthorized or suspicious JavaScript content.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to detect and block NoSQL injection patterns, specifically targeting requests to the \u003ccode\u003egetPasswordPolicy\u003c/code\u003e method containing \u003ccode\u003e$regex\u003c/code\u003e or other database operator syntax.\u003c/li\u003e\n\u003cli\u003eHunt for evidence of unauthorized account password resets and newly created webhook integrations in application logs.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-28T21:28:01Z","date_published":"2026-10-28T21:28:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rocketchat-cve-2021-22911/","summary":"A critical unauthenticated NoSQL injection vulnerability in Rocket.Chat versions prior to 3.12.7 allows attackers to reset administrator credentials and achieve remote code execution via malicious webhook integration scripts.","title":"Rocket.Chat: Unauthenticated NoSQL Injection and Remote Code Execution (CVE-2021-22911)","url":"https://feed.craftedsignal.io/briefs/2026-10-rocketchat-cve-2021-22911/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rocket.chat:rocket.chat:3.13.0:-:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}