Command Injection Vulnerability in Rocket.Chat-Desktop Application

CVE-2022-44567

What is CVE-2022-44567?

A command injection vulnerability exists in the Rocket.Chat-Desktop application versions earlier than 3.8.14. This flaw allows attackers to exploit the openInternalVideoChatWindow function, which can lead to remote code execution if a malicious URL is passed to the shell.openExternal() method. The risk is heightened when the internal video chat window is disabled or if the application is built from the Mac App Store. Moreover, the exposed function may be susceptible to an XSS attack, thus increasing the threat landscape for users.

References