RocketChat / RocketChat/Rocket.Chat
Passwords stored in cleartext for webdav in MongoDB
Open
Nobody has claimed this yet.
security
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The WebDAV accounts for every user are stored in the mongoDB. Here the passwords are stored in cleartext. Actually it's a serious security issue if you're using Rocketchat in a company.
Steps to reproduce:
- Add a WebDAV Account in your Rocket.Chat Client
- Go to your MongoDB Server/Container and open mongodb shell:
2.1use rocketchat
2.2db.rocketchat_webdav_accounts.find()
Expected behavior:
Some hashed passwords
Actual behavior:
Passwords are stored in cleartext and for everyone with db access visible
Server Setup Information:
- Version of Rocket.Chat Server: 3.7.0
- Deployment Method: Docker
- MongoDB Version: 4.0
Client Setup Information
- Desktop App or Browser Version: 3.0.3
- Operating System: Every OS
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the WebDAV account persistence path that writes to the rocketchat_webdav_accounts collection, then inspect how stored credentials are handled. Reproduce the MongoDB query from the issue and verify that the resulting records no longer expose cleartext passwords.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mongodb
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100