Improper Input Sanitization in Rocket.Chat Server by Rocket.Chat
CVE-2021-22911

9.8CRITICAL

Key Information:

Vendor: Rocket.chat
Status: Rocket.chat Server
Vendor: CVE Published:; 27 May 2021

🔔 Create Rocket.chat Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 92%

What is CVE-2021-22911?

An improper input sanitization vulnerability in Rocket.Chat Server versions 3.11, 3.12, and 3.13 could allow attackers to perform unauthenticated NoSQL injection attacks. This vulnerability potentially enables remote code execution (RCE), posing significant risks to users and their data. Organizations utilizing affected versions of Rocket.Chat are encouraged to implement immediate security measures.

Affected Version(s)

Rocket.Chat server Fixed in: 3.13.2, 3.12.4, 3.11.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-22911
Created by CsEnox

Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911
Created by optionalCTF

CVE-2021-22911-rust
Created by ChrisPritchard