Merge pull request #4518 from noraj/patch-1

rocketchat-unauth-access: add ref + rem

vulnerabilities/rocketchat/unauth-message-read.yaml

@@ -4,9 +4,13 @@ info:
   name: RocketChat Unauthenticated Read Access
   author: rojanrijal
   severity: critical
-  description: An issue with the Live Chat accepting invalid parameters could potentially allow unauthenticated access to messages and user tokens.
+  description: |
+    An issue with the Live Chat accepting invalid parameters could potentially allow unauthenticated access to messages and user tokens.
   reference:
     - https://docs.rocket.chat/guides/security/security-updates
+    - https://securifyinc.com/disclosures/rocketchat-unauthenticated-access-to-messages
+  remediation: |
+    Fixed on 3.11, 3.10.5, 3.9.7, 3.8.8.
   tags: rocketchat,unauth
 
 requests:
@@ -30,12 +34,14 @@ requests:
 
     matchers-condition: and
     matchers:
-      - type: status
-        status:
-          - 200
+
       - type: word
+        part: body
         words:
           - '"{\"msg\":\"result\",\"result\":{\"messages\"'
           - '"success":true'
-        part: body
         condition: and
+
+      - type: status
+        status:
+          - 200