CVE-2021-22911
84Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 95%
da publicação à arma9 dias
Publicada no NVD27 de mai.
1ª PoC+9d
VulnCheck+901d
probabilidade de exploração
95%top 1% das CVEs
exploração observada
simVulnCheck
26 exploit(s) público(s)
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
Produtos afetados
n/a · Rocket.Chat serverPoCs públicas encontradas — 26✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/49960exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/50108githubgithub.com/CsEnox/CVE-2021-22911★ 60githubgithub.com/optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911★ 9githubgithub.com/Faridi-m/CVE-2021-22911-RocketChat★ 2githubgithub.com/roshanrajbanshi/rocketcat-cve-2021-22911-exploit★ 0githubgithub.com/overgrowncarrot1/CVE-2021-22911★ 0githubgithub.com/ChrisPritchard/CVE-2021-22911-rust★ 0githubgithub.com/jayngng/CVE-2021-22911★ 0githubgithub.com/octodi/CVE-2021-22911★ 0githubgithub.com/TeneBrae93/RocketChat-NoSQLi-Chain-CVE-2021-22911★ 0githubgithub.com/yoohhuu/Rocket-Chat-3.12.1-PoC-CVE-2021-22911-★ 0githubgithub.com/MrDottt/CVE-2021-22911★ 0vulncheckvulncheck.com/xdb/7e30455fc824não verificadocve_referencepacketstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlnão verificadocve_referencepacketstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlnão verificadovulncheckvulncheck.com/xdb/fea071c9ad62não verificadovulncheckvulncheck.com/xdb/d1c0203f5bc0não verificadovulncheckvulncheck.com/xdb/94fbab710c8enão verificadovulncheckvulncheck.com/xdb/9bf9c3e084benão verificadovulncheckvulncheck.com/xdb/6d83697d150enão verificadovulncheckvulncheck.com/xdb/0beee03e8b56não verificadovulncheckvulncheck.com/xdb/eedeb345f12bnão verificadovulncheckvulncheck.com/xdb/5eec00088786não verificadovulncheckvulncheck.com/xdb/4c114b9573benão verificadovulncheckvulncheck.com/xdb/94a3e2ed78d5não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlhttp://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlhttps://blog.sonarsource.com/nosql-injections-in-rocket-chathttps://hackerone.com/reports/1130721