CVE-2022-32211 Questions

[Geomas]

Does CVE-2022-32211 affect version 4.7.0 of Rocket.Chat?

Also, how can one ascertain whether one’s Rocket.Chat server has been compromised?

[Geomas]

Additional questions:

What, if anything, can be done to mitigate the risk of this vulnerability short of updating Rocket.Chat?

I am presently unable to update Rocket.Chat owing to the problem I described here:

Update from 4.7.0 to 4.8.1 Fails

Description I’m running Rocket.Chat on a DigitalOcean droplet installed via the provided pre-configured snap package. When I run rocketchatctl update, the update fails with the following terminal output: Updates could be risky, you can use the backup option # rocketchatctl backup, to create a backup of the rocketchat database first. Please check that you have enough space in your system to store the backup. Current update available for RocketChat server: from 4.7 to 4.8.1. /usr/local/bin/roc…

Would it be advisable to simply shut down my server?

[dudanogueira]

Hi!

You can always prevent external access. As you are running on a VPS, let’s try upgrading it

I have missed your last message, and have just answered it to something that may help.

Please, consider joining our Community Support Channel so others can also jump in and help you out. (Don’t forget to post the link to the forums so we can keep things in sync )

Thanks!

[Geomas]

I registered a new account on open.rocket.chat using the same user name as here. However, even after email address verification, when I attempt to log in, I receive “User not found or incorrect password” notice.