CVE-2021-22911
📋 TL;DR
CVE-2021-22911 is an improper input sanitization vulnerability in Rocket.Chat that allows unauthenticated attackers to perform NoSQL injection attacks. This can lead to remote code execution on affected servers. Organizations running vulnerable Rocket.Chat versions 3.11-3.13 are at risk.
💻 Affected Systems
- Rocket.Chat
📦 What is this software?
Rocket.chat by Rocket.chat
Rocket.chat by Rocket.chat
Rocket.chat by Rocket.chat
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, access sensitive data, and pivot to other systems.
Likely Case
Unauthenticated attackers gain remote code execution, potentially leading to data theft, ransomware deployment, or botnet recruitment.
If Mitigated
Attack attempts are blocked at network perimeter or detected before successful exploitation.
🎯 Exploit Status
Multiple public exploit scripts and detailed technical analysis available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.13.1 and later
Vendor Advisory: https://github.com/RocketChat/Rocket.Chat/releases/tag/3.13.1
Restart Required: Yes
Instructions:
1. Backup your Rocket.Chat instance and database. 2. Update to Rocket.Chat 3.13.1 or later using your package manager or deployment method. 3. Restart the Rocket.Chat service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to Rocket.Chat server to trusted IP addresses only
iptables -A INPUT -p tcp --dport 3000 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Rocket.Chat server
- Deploy a web application firewall (WAF) with NoSQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check Rocket.Chat version via admin panel or by examining package versionCheck Version:
rocketchatctl version or check package manager (apt list --installed | grep rocketchat)Verify Fix Applied:
Confirm version is 3.13.1 or higher and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Unusual MongoDB queries in logs
- Unexpected process execution
- Authentication bypass attempts
Network Indicators:
- Suspicious HTTP POST requests to Rocket.Chat endpoints with NoSQL operators
- Outbound connections from Rocket.Chat server to unknown destinations
SIEM Query:
source="rocketchat.log" AND ("$ne" OR "$regex" OR "$where")🔗 References
- http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
- http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
- https://blog.sonarsource.com/nosql-injections-in-rocket-chat
- https://hackerone.com/reports/1130721
- http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
- http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
- https://blog.sonarsource.com/nosql-injections-in-rocket-chat
- https://hackerone.com/reports/1130721
