RocketChat / RocketChat/Rocket.Chat
Mobile app can still change username even when disabled by the server
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Before you say it's not related to server application read whole description.
We use in our office google play app to work with rocket.chat link. We noticed that app allow changing usernames when we blocked this feature in server application. Moreover app does not force logout user when his token is not up to date. So the user can still use the chat even if he shouldn't.
You can say that the app has vulnerabilities. In fact i can write my own app an hack the chat. So server shoud not allow to that things.
- Version of Rocket.Chat Server: 0.64.1
- Operating System: Centos 7
- Deployment Method: docker
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior with the Android app against the reported Rocket.Chat Server 0.64.1 setup, with username changes disabled and an outdated token. Trace the server-side setting enforcement and token invalidation behavior; done means disabled username changes are rejected and users with stale tokens are forced out.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100