CVE-2021-22911 — AI Deep Analysis Summary

🚨 **Essence**: A Pre-Auth Blind NoSQL Injection in Rocket.Chat. 💥 **Consequences**: Attackers can hijack accounts via leaked password reset tokens.…

🛡️ **Root Cause**: **CWE-75** (NoSQL Injection). The flaw lies in the `getPasswordPolicy` endpoint.…

📦 **Affected**: Rocket.Chat Server versions **3.11**, **3.12**, and **3.13** (specifically tested on 3.12.1). 🌐 **Component**: The password reset mechanism (`getPasswordPolicy` method).

🕵️ **Attacker Capabilities**: 1. **Unauthenticated Account Takeover**: Leak password reset tokens for any user. 2. **Privilege Escalation**: Take over Admin accounts. 3.…

⚡ **Threshold**: **LOW**. No authentication or authorization is required to trigger the injection. It is a **Pre-Auth** vulnerability, making it extremely easy to exploit for any internet-facing instance.

💣 **Public Exploits**: **YES**. Multiple PoCs are available on GitHub (e.g., by CsEnox, optionalCTF, ChrisPritchard). Automated scripts exist for account takeover and RCE. 📥 **Exploit-DB**: ID 49960.

🔍 **Self-Check**: 1. Check Rocket.Chat version (3.11-3.13). 2. Scan for the `getPasswordPolicy` endpoint. 3. Test if the password reset token parameter accepts JSON injection payloads (like `$regex`). 4.…

🩹 **Fix Status**: **YES**. The vulnerability was published in May 2021. Users must upgrade to a patched version of Rocket.Chat immediately. 📢 **Reference**: SonarSource blog and official CVE details.

🚧 **Workaround (If No Patch)**: 1. **Block Access**: Restrict access to the `/api/v1/method.getPasswordPolicy` endpoint via WAF or firewall. 2.…

🔥 **Urgency**: **CRITICAL**. Since it allows **Unauthenticated RCE**, it is a high-priority target for attackers. Immediate patching or mitigation is required to prevent full server compromise. 🏃‍♂️💨