Rocket.Chat up to 0.65 username.html Reflected cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in Rocket.Chat up to 0.65. The impacted element is an unknown function of the file packages/rocketchat-ui-login/client/username/username.html. Such manipulation leads to cross site scripting (Reflected). This vulnerability is uniquely identified as CVE-2018-13879. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Rocket.Chat up to 0.65 (Chat Software) and classified as problematic. Affected by this issue is some unknown functionality of the file packages/rocketchat-ui-login/client/username/username.html. The manipulation with an unknown input leads to a cross site scripting vulnerability (Reflected). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.

The bug was discovered 05/17/2018. The weakness was disclosed 07/11/2018 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2018-13879 since 07/10/2018. The attack may be launched remotely. A simple authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 54 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:packages/rocketchat-ui-login/client/username/username.html it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.66 eliminates this vulnerability.

The entry VDB-121171 is pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Rocket.Chat

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64
• 0.65

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion