RocketChat / RocketChat/Rocket.Chat
Rocket.Chat include the LDAP password in clear text in the statistics.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
In the log in the Admin UI we saw, that Rocket.Chat saves our LDAP password in clear text within the statistics. I'm unsure if the Rocket.Chat company has access to this statistics and now knows our LDAP connection data.
Steps to reproduce:
- Go into the Admin UI.
- Open the log.
- Search for the statistics object.
Expected behavior:
No LDAP password inside the statistics.
Actual behavior:
LDAP password inside the statistics.
Server Setup Information:
- Version of Rocket.Chat Server: 3.14.6
- Operating System: Ubuntu 18.04
- Deployment Method: docker
- Number of Running Instances: 2
- DB Replicaset Oplog: yes
- NodeJS Version: v12.22.1
- MongoDB Version: 4.0.25
Client Setup Information
- Desktop App or Browser Version: Firefox 89.0.2
- Operating System: Win 10
Additional context
none
Relevant logs:
I won't post my logfile, because there is our LDAP password readable ;)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue from the Admin UI log and inspect the statistics object for the LDAP password. Trace where that object is assembled and verify that the password is absent from the resulting statistics and logs, including for the reported Rocket.Chat 3.14.6 setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100