Prototype Pollution in Rocket.Chat Server by Rocket.Chat

CVE-2023-23917

What is CVE-2023-23917?

A vulnerability exists in Rocket.Chat Server versions prior to 5.2.0, allowing attackers to exploit prototype pollution, potentially leading to remote code execution (RCE) with admin privileges. Any user can set up their own server within the cloud infrastructure, effectively granting them admin access and enabling the exploitation of this vulnerability. Moreover, the attack vector may amplify the risks associated with cross-site scripting (XSS), posing additional security challenges for self-hosted environments.

References