RocketChat / RocketChat/Rocket.Chat
Cannot read encrypted room messages after E2E password reset
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
If you get invited to a encrypted group before you entered your E2E password and then reset it, youll not be able to read the messages in this group.
Steps to reproduce:
Account: Worker [has his E2E password entered]
Account: Victim [doesnt, also he has forgotten his e2e password]
Account: Admin [selfexplanatory]
- Create with [Worker] a private, encrypted group and invite [Victim]
- Reset the e2e password of [Victim] with [Admin]
Expected behavior:
After the steps [Victim] can read any new messages in the encrypted group. [Victim] also can write messages.
Actual behavior:
[Victim] can not send messages (no feedback, enter in textbox just does not work) in the encrypted group.
[Victim] can't see new messages in this group, he only see the placehodler-stars (******).
If [Victim] opens the direct link to the room, he gets redirected to the default channel.
Server Setup Information:
- Version of Rocket.Chat Server: 0.74.0
- Operating System: OpenSuse
- Deployment Method: tar
- Number of Running Instances: 1
- DB Replicaset Oplog: disabled
- NodeJS Version: v8.11.4
- MongoDB Version: 3.6.2
Additional context
Is there an manual way to fix this problem except recreating User or Group?
Relevant logs:
(If Victim does a refresh after reproducing the steps)
Server-Log:
2019-01-28T15:40:28.685581+01:00 rocketchatserver rocketchat[752]: at Array.forEach (<anonymous>)
2019-01-28T15:40:28.687383+01:00 rocketchatserver rocketchat[752]: at MethodInvocation.<anonymous> (packages/rocketchat:notifications/server/lib/Notifications.js:77:19)
2019-01-28T15:40:28.687939+01:00 rocketchatserver rocketchat[752]: at Streamer.isWriteAllowed (packages/rocketchat:streamer/server/server.js:217:38)
2019-01-28T15:40:28.688449+01:00 rocketchatserver rocketchat[752]: at MethodInvocation.method.(anonymous function) (packages/rocketchat:streamer/server/server.js:349:15)
2019-01-28T15:40:28.688878+01:00 rocketchatserver rocketchat[752]: at MethodInvocation.methodMap.(anonymous function) (packages/rocketchat_monitoring.js:2731:30)
2019-01-28T15:40:28.689442+01:00 rocketchatserver rocketchat[752]: at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1767:12)
2019-01-28T15:40:28.689892+01:00 rocketchatserver rocketchat[752]: at DDP._CurrentMethodInvocation.withValue (packages/ddp-server/livedata_server.js:719:19)
2019-01-28T15:40:28.690452+01:00 rocketchatserver rocketchat[752]: at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12)
2019-01-28T15:40:28.690876+01:00 rocketchatserver rocketchat[752]: at DDPServer._CurrentWriteFence.withValue (packages/ddp-server/livedata_server.js:717:46)
2019-01-28T15:40:28.691297+01:00 rocketchatserver rocketchat[752]: at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12)
2019-01-28T15:40:28.691828+01:00 rocketchatserver rocketchat[752]: at Promise (packages/ddp-server/livedata_server.js:715:46)
2019-01-28T15:40:28.692558+01:00 rocketchatserver rocketchat[752]: at new Promise (<anonymous>)
2019-01-28T15:40:28.693118+01:00 rocketchatserver rocketchat[752]: at Session.method (packages/ddp-server/livedata_server.js:689:23)
2019-01-28T15:40:28.693712+01:00 rocketchatserver rocketchat[752]: at packages/ddp-server/livedata_server.js:559:43
Chrome-Log from [Victim]:
48d6d2c……js_resource=true:59 WebSocket connection to 'wss://rocketchatserver/sockjs/840/4j0kyf_i/websocket' failed: Error during WebSocket handshake: Unexpected response code: 400
48d6d2c……s_resource=true:433 Loading: true
15
[Violation] Added non-passive event listener to a scroll-blocking <some> event. Consider marking event handler as 'passive' to make the page more responsive. See <URL>
48d6d2c……_js_resource=true:5 Deprecation warning: use moment.updateLocale(localeName, config) to change an existing locale. moment.defineLocale(localeName, config) should only be used for creating a new locale See http://momentjs.com/guides/#/warnings/define-locale/ for more info.
48d6d2c……s_resource=true:195 E2E -> Initiating handshake
48d6d2c……s_resource=true:195 E2E -> Requesting room key
48d6d2c……_js_resource=true:1 Error invoking Method 'stream-notify-room-users'
r {isClientSafe: true, error: 500, reason: "Internal server error", details: undefined, message: "Internal server error [500]", …}
details: undefined
error: 500
errorType: "Meteor.Error"
isClientSafe: true
message: "Internal server error [500]"
reason: "Internal server error"
stack: ""Error: Internal server error [500]
at w._livedata_result (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:61:17834)
at w.onMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:61:20175)
at currentStatus.connected.forEachCallback.e (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:2772)
at Array.forEach (<anonymous>)
at l.forEachCallback (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:3967)
at k.socket.onmessage.t [as onmessage] (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:2742)
at k.r.dispatchEvent (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:6474)
at k._dispatchMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:20111)
at k._didMessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:21011)
at rt.e.onmessage (https://rocketchatserver/48d6d2c46a0a2951701c2f7c0f19e33c80c18724.js?meteor_js_resource=true:59:33758)"
__proto__: Error
Friendly greets and thanks in advance,
Ystro
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the server stack trace in packages/rocketchat:notifications/server/lib/Notifications.js and packages/rocketchat:streamer/server/server.js, then follow the client E2E handshake and room-key request. Reproduce the password-reset flow and verify that the affected user can read new messages and send messages in the encrypted group without being redirected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- full-stack, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100