RocketChat / RocketChat/Rocket.Chat

Cannot read encrypted room messages after E2E password reset

Open
#13,276 8 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

If you get invited to a encrypted group before you entered your E2E password and then reset it, youll not be able to read the messages in this group.

Steps to reproduce:

Account: Worker [has his E2E password entered]
Account: Victim [doesnt, also he has forgotten his e2e password]
Account: Admin [selfexplanatory]

  1. Create with [Worker] a private, encrypted group and invite [Victim]
  2. Reset the e2e password of [Victim] with [Admin]
Expected behavior:

After the steps [Victim] can read any new messages in the encrypted group. [Victim] also can write messages.

Actual behavior:

[Victim] can not send messages (no feedback, enter in textbox just does not work) in the encrypted group.
[Victim] can't see new messages in this group, he only see the placehodler-stars (******).
If [Victim] opens the direct link to the room, he gets redirected to the default channel.

Server Setup Information:
  • Version of Rocket.Chat Server: 0.74.0
  • Operating System: OpenSuse
  • Deployment Method: tar
  • Number of Running Instances: 1
  • DB Replicaset Oplog: disabled
  • NodeJS Version: v8.11.4
  • MongoDB Version: 3.6.2
Additional context

Is there an manual way to fix this problem except recreating User or Group?

Relevant logs:

(If Victim does a refresh after reproducing the steps)
Server-Log:

2019-01-28T15:40:28.685581+01:00 rocketchatserver rocketchat[752]:     at Array.forEach (<anonymous>)
2019-01-28T15:40:28.687383+01:00 rocketchatserver rocketchat[752]:     at MethodInvocation.<anonymous> (packages/rocketchat:notifications/server/lib/Notifications.js:77:19)
2019-01-28T15:40:28.687939+01:00 rocketchatserver rocketchat[752]:     at Streamer.isWriteAllowed (packages/rocketchat:streamer/server/server.js:217:38)
2019-01-28T15:40:28.688449+01:00 rocketchatserver rocketchat[752]:     at MethodInvocation.method.(anonymous function) (packages/rocketchat:streamer/server/server.js:349:15)
2019-01-28T15:40:28.688878+01:00 rocketchatserver rocketchat[752]:     at MethodInvocation.methodMap.(anonymous function) (packages/rocketchat_monitoring.js:2731:30)
2019-01-28T15:40:28.689442+01:00 rocketchatserver rocketchat[752]:     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1767:12)
2019-01-28T15:40:28.689892+01:00 rocketchatserver rocketchat[752]:     at DDP._CurrentMethodInvocation.withValue (packages/ddp-server/livedata_server.js:719:19)
2019-01-28T15:40:28.690452+01:00 rocketchatserver rocketchat[752]:     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12)
2019-01-28T15:40:28.690876+01:00 rocketchatserver rocketchat[752]:     at DDPServer._CurrentWriteFence.withValue (packages/ddp-server/livedata_server.js:717:46)
2019-01-28T15:40:28.691297+01:00 rocketchatserver rocketchat[752]:     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12)
2019-01-28T15:40:28.691828+01:00 rocketchatserver rocketchat[752]:     at Promise (packages/ddp-server/livedata_server.js:715:46)
2019-01-28T15:40:28.692558+01:00 rocketchatserver rocketchat[752]:     at new Promise (<anonymous>)
2019-01-28T15:40:28.693118+01:00 rocketchatserver rocketchat[752]:     at Session.method (packages/ddp-server/livedata_server.js:689:23)
2019-01-28T15:40:28.693712+01:00 rocketchatserver rocketchat[752]:     at packages/ddp-server/livedata_server.js:559:43

Chrome-Log from [Victim]:

48d6d2c……js_resource=true:59 WebSocket connection to 'wss://rocketchatserver/sockjs/840/4j0kyf_i/websocket' failed: Error during WebSocket handshake: Unexpected response code: 400
48d6d2c……s_resource=true:433 Loading: true
15
[Violation] Added non-passive event listener to a scroll-blocking <some> event. Consider marking event handler as 'passive' to make the page more responsive. See <URL>
48d6d2c……_js_resource=true:5 Deprecation warning: use moment.updateLocale(localeName, config) to change an existing locale. moment.defineLocale(localeName, config) should only be used for creating a new locale See http://momentjs.com/guides/#/warnings/define-locale/ for more info.
48d6d2c……s_resource=true:195 E2E -> Initiating handshake
48d6d2c……s_resource=true:195 E2E -> Requesting room key
48d6d2c……_js_resource=true:1 Error invoking Method 'stream-notify-room-users' 
r {isClientSafe: true, error: 500, reason: "Internal server error", details: undefined, message: "Internal server error [500]", …}
details: undefined
error: 500
errorType: "Meteor.Error"
isClientSafe: true
message: "Internal server error [500]"
reason: "Internal server error"
stack: ""Error: Internal server error [500]
    at w._livedata_result (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:61:17834)
    at w.onMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:61:20175)
    at currentStatus.connected.forEachCallback.e (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:2772)
    at Array.forEach (<anonymous>)
    at l.forEachCallback (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:3967)
    at k.socket.onmessage.t [as onmessage] (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:2742)
    at k.r.dispatchEvent (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:6474)
    at k._dispatchMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:20111)
    at k._didMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:21011)
    at rt.e.onmessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:33758)"
__proto__: Error

Friendly greets and thanks in advance,
Ystro

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the server stack trace in packages/rocketchat:notifications/server/lib/Notifications.js and packages/rocketchat:streamer/server/server.js, then follow the client E2E handshake and room-key request. Reproduce the password-reset flow and verify that the affected user can read new messages and send messages in the encrypted group without being redirected.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
full-stack, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.