CVE-2021-22911
84Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 95%
de la publicación al arma9 días
Publicada en NVD27 may
1ª PoC+9d
VulnCheck+901d
probabilidad de explotación
95%top 1% de las CVE
explotación observada
síVulnCheck
26 exploit(s) público(s)
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
Productos afectados
n/a · Rocket.Chat serverPoCs públicas encontradas — 26✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/49960exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/50108githubgithub.com/CsEnox/CVE-2021-22911★ 61githubgithub.com/optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911★ 9githubgithub.com/Faridi-m/CVE-2021-22911-RocketChat★ 2githubgithub.com/octodi/CVE-2021-22911★ 0githubgithub.com/TeneBrae93/RocketChat-NoSQLi-Chain-CVE-2021-22911★ 0githubgithub.com/roshanrajbanshi/rocketcat-cve-2021-22911-exploit★ 0githubgithub.com/MrDottt/CVE-2021-22911★ 0githubgithub.com/jayngng/CVE-2021-22911★ 0githubgithub.com/ChrisPritchard/CVE-2021-22911-rust★ 0githubgithub.com/overgrowncarrot1/CVE-2021-22911★ 0githubgithub.com/yoohhuu/Rocket-Chat-3.12.1-PoC-CVE-2021-22911-★ 0vulncheckvulncheck.com/xdb/7e30455fc824no verificadocve_referencepacketstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/fea071c9ad62no verificadovulncheckvulncheck.com/xdb/d1c0203f5bc0no verificadovulncheckvulncheck.com/xdb/94fbab710c8eno verificadovulncheckvulncheck.com/xdb/9bf9c3e084beno verificadovulncheckvulncheck.com/xdb/6d83697d150eno verificadovulncheckvulncheck.com/xdb/0beee03e8b56no verificadovulncheckvulncheck.com/xdb/eedeb345f12bno verificadovulncheckvulncheck.com/xdb/5eec00088786no verificadovulncheckvulncheck.com/xdb/4c114b9573beno verificadovulncheckvulncheck.com/xdb/94a3e2ed78d5no verificadocve_referencepacketstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlhttp://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.htmlhttps://blog.sonarsource.com/nosql-injections-in-rocket-chathttps://hackerone.com/reports/1130721