CVE-2024-46935: Rocket.Chat message parser denial of service

CVE-2024-46935 · Severity: low · CVSS 3.1 · Published 2024-09-25

Rocket.Chat, a widely-used team communication and collaboration platform, contains a vulnerability in its message parsing logic that can be exploited to crash the workspace. An attacker can craft specially-formatted messages containing specific characters that cause the message parser to consume excessive resources, resulting in a denial of service that disrupts all users on the affected instance.

Technologies: Rocket.Chat. Vendors: npm, Rocket.Chat.

Quick answers

Is CVE-2024-46935 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-46935 being exploited in the wild.
How severe is CVE-2024-46935?
Low severity, with a CVSS score of 3.1, published 25 September 2024.
Which products and versions are affected?
@rocket.chat/message-parser (npm) SEMVER:introduced=0,fixed=0.31.30; Rocket.Chat Message-Parser before 0.31.30; Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier.
Is there a fix for CVE-2024-46935?
Yes. @rocket.chat/message-parser (npm): upgrade to 0.31.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-46935 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-46935?
Check whether you run @rocket.chat/message-parser (npm), Rocket.Chat Message-Parser or Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @rocket.chat/message-parser (npm): upgrade to 0.31.30 or later
    npm install @rocket.chat/message-parser@0.31.30

Technical details

The vulnerability exists in Rocket.Chat's message parser component (@rocket.chat/message-parser), which fails to efficiently handle messages containing excessive symbols or specific character sequences. An unauthenticated remote attacker can send a crafted message that triggers catastrophic performance degradation in the parser, consuming significant CPU or memory resources and causing the workspace to become unresponsive or crash. The root cause is related to CWE-400 (uncontrolled resource consumption) in the message parsing logic. The fix was merged in PR #33227 and is available in Rocket.Chat 6.12.1 and later, as well as in message-parser version 0.31.30 and above.

Affected products

  • Rocket.Chat Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier
  • Rocket.Chat message-parser before 0.31.30

Identifiers

  • CVE-2024-46935
  • GHSA-6375-pg5j-8wph

Timeline

  • 2024-09-25: disclosed: Vulnerability publicly disclosed
  • 2024-09-25: patched: Fix released in Rocket.Chat 6.12.1 and message-parser 0.31.30

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.