NoSQL Injections in Rocket.Chat 3.12.1: How A Small Leak Grounds A Rocket by Paul Gerste RCE on Rocket.Chat servers via MongoDB noSQLi. Valid account required. Contents: • Impact • Technical Details • MongoDB Injection Primer • NoSQL Injection #1: Taking Over a Regular User • NoSQL Injection #2: Elevating Privileges • From Admin to Remote Code Execution • Mitigation • Timeline • Summary https://blog.sonarsource.com/nosql-injections-in-rocket-chat/ 480 views17:43
