CVE-2022-35246 in Rocket.Chat
Summary
by MITRE • 09/23/2022
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/23/2025
The CVE-2022-35246 vulnerability represents a critical information disclosure flaw in Rocket.Chat versions prior to 5.0.0, 4.8.2, and 4.7.5 respectively. This vulnerability specifically affects the getS3FileUrl Meteor server method which is responsible for generating and returning file URLs from Amazon S3 storage systems. The flaw allows authenticated users to exploit a NoSQL injection vulnerability that bypasses normal access controls and permissions mechanisms. The vulnerability stems from improper input validation and sanitization within the server-side method that processes file URL requests, enabling attackers to manipulate the underlying NoSQL queries used to retrieve file metadata and access information.
The technical implementation of this vulnerability occurs through the manipulation of input parameters passed to the getS3FileUrl method, which directly translates into NoSQL injection attacks against the database layer. When users submit requests for S3 file URLs, the application fails to properly validate or sanitize the incoming data, allowing attackers to inject malicious NoSQL query operators that alter the intended database query behavior. This injection allows unauthorized access to file URLs that should normally be restricted to specific user roles or permissions, effectively bypassing the application's access control mechanisms.
The operational impact of this vulnerability is significant as it enables unauthorized users to gain access to files that they should not be permitted to view, potentially exposing sensitive information including confidential documents, user data, or system-related files stored in the S3 buckets. The disclosure occurs through the generation of URLs that point to files in the cloud storage system, meaning that attackers can potentially access not only their own uploaded files but also those belonging to other users within the same instance. This information disclosure threat can lead to data breaches, privacy violations, and potential escalation to further attacks within the system, as attackers can now access files that may contain additional sensitive data or system information.
The vulnerability aligns with CWE-94, which describes the weakness of allowing code injection in a NoSQL context, and relates to ATT&CK technique T1078 which covers legitimate credentials usage for persistence and privilege escalation. Organizations using Rocket.Chat versions affected by this vulnerability should immediately implement the available patches and updates from the vendor, while also implementing additional monitoring for unauthorized file access patterns. Network segmentation and proper access control enforcement should be reviewed to minimize potential impact, and regular security assessments should be conducted to identify similar vulnerabilities in other server-side methods that handle external data inputs. The fix typically involves proper input validation, parameterized queries, and enhanced access control checks within the getS3FileUrl method to prevent unauthorized disclosure of file URLs through NoSQL injection techniques.