Cross-Room Data Exposure via Query Parameter Injection

Issue: P0 - Cross-Room Data Exposure via Query Parameter Injection

Severity: Critical (P0)

Description

When the legacy unsafe query mode is enabled (ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE), user-supplied query parameters can override enforced room ID (rid) filters in API endpoints. This allows any authenticated user to access messages and files from rooms they don't have access to.

Vulnerable Code Locations

• apps/meteor/app/api/server/v1/im.ts - Lines 337, 508, 562
• apps/meteor/app/api/server/v1/channels.ts - Lines 307, 825
• apps/meteor/app/api/server/v1/groups.ts - Lines 405, 791

Attack Vector

1. Attacker enables ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS (admin setting)
2. Makes API request to /im.messages, /channels.messages, etc.
3. Provides custom query: {"rid": "target-room-id", "otherFilter": "value"}
4. Server merges query with server constraints: {...query, rid: allowed_room_id}
5. Due to JavaScript spread order, user's rid OVERRIDES server's rid
6. Attacker gains access to target room's data

Expected Behavior

Server-enforced room constraints (rid) should ALWAYS take precedence and cannot be overridden by user-supplied query parameters.

Fix Applied

• Filter out protected keys (rid) from user query before merging
• Apply consistently across all affected endpoints

Start by reading the query handling at the listed lines in im.ts, channels.ts, and groups.ts, focusing on how user parameters are merged with enforced room constraints. Verify the affected message and file endpoints reject a user-supplied rid and preserve the server-enforced room ID consistently across all six locations.