漏洞描述
Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
packetstormsecurity.comhttp://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html↗github.comhttps://github.com/vulhub/vulhub/tree/master/rocketchat/CVE-2021-22911↗hackerone.comhttps://hackerone.com/reports/1130721↗cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22911↗blog.sonarsource.comhttps://blog.sonarsource.com/nosql-injections-in-rocket-chat↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-22911↗