Executive brief
Rocket.Chat is a popular open-source team communication platform. A Server-Side Request Forgery vulnerability in the Twilio webhook endpoint allows an attacker to make unauthorized network requests from the server, potentially accessing internal systems or sensitive data that should not be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Rocket.Chat's Twilio webhook integration prior to version 6.10.1. The vulnerability is classified as CWE-918 and allows an attacker to craft requests that cause the server to fetch arbitrary URLs. The attack requires network access to the webhook endpoint but no authentication or user interaction. An attacker can leverage this to access internal services, metadata endpoints, or sensitive network resources normally restricted to the server's internal network. The fix is available in Rocket.Chat version 6.10.1 and later.
Affected products
- Rocket.Chat Rocket.Chat before 6.10.1
Timeline
- 2024-08-05: disclosed
- 2024-07-24: patched: Fix committed to repository