CVE-2023-23917

A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://hackerone.com/reports/1631258	Permissions Required
https://hackerone.com/reports/1631258	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de contaminación de prototipos existe en el servidor Rocket.Chat anterior a 5.2.0 que podría permitir a un atacante obtener una RCE bajo la cuenta de administrador. Cualquier usuario puede crear su propio servidor en su nube y convertirse en administrador, por lo que esta vulnerabilidad podría afectar la infraestructura de la nube. Este vector de ataque también puede aumentar el impacto de XSS a RCE, lo cual es peligroso también para los usuarios autoalojados.

Information

Published : 2023-02-23 20:15

Updated : 2026-10-24 13:10

NVD link : CVE-2023-23917

Mitre link : CVE-2023-23917

CVE.ORG link : CVE-2023-23917

JSON object : View

Products Affected

rocket.chat

rocket.chat

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2023-23917", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-23917", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-03-12T17:55:58.128249Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "n/a", "product": "Rocket.chat", "versions": [{"status": "affected", "version": "Fixed Version => 5.2.0"}]}]}], "published": "2023-02-23T20:15:13.847", "references": [{"url": "https://hackerone.com/reports/1631258", "tags": ["Permissions Required"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/1631258", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1321"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well."}, {"lang": "es", "value": "Una vulnerabilidad de contaminaci\u00f3n de prototipos existe en el servidor Rocket.Chat anterior a 5.2.0 que podr\u00eda permitir a un atacante obtener una RCE bajo la cuenta de administrador. Cualquier usuario puede crear su propio servidor en su nube y convertirse en administrador, por lo que esta vulnerabilidad podr\u00eda afectar la infraestructura de la nube. Este vector de ataque tambi\u00e9n puede aumentar el impacto de XSS a RCE, lo cual es peligroso tambi\u00e9n para los usuarios autoalojados."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E33A3CA1-AFAC-4F61-93E3-E16070C99CEB", "versionEndExcluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}