Rocket.Chat Regular Expression Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Rocket.Chat versions through 7.6.1. The issue arises in the 'parseMessage' function within the file '/apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js'. The vulnerability is caused by an inefficient regular expression that can be exploited by embedding maliciously crafted input, leading to excessive CPU usage and application freezing. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability causes a regular expression denial-of-service, where the application becomes unresponsive due to high CPU consumption from processing the crafted input.

Reproduction

The vulnerability can be reproduced by sending a message that includes a large amount of trailing whitespace and a null character, which the 'parseMessage' function will process. This can be done using a script that measures the time taken to parse the message, demonstrating the impact of the denial-of-service condition.

Remediation

No specific mitigation is known, but it is recommended to update to a version of Rocket.Chat that addresses this vulnerability.