Summary

A vulnerability in Rocket.Chat <6.12.0 allows low-privileged users, if they know an app ID, to access sensitive information about configured OAuth applications by invoking an API endpoint that lacks proper authorization checks.

Details

In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret.

PoC

Steps to Reproduce:

1. Log in as a regular (non-admin) user.
2. Obtain your X-Auth-Token and X-User-Id.
3. Send the following HTTP request:

GET /api/v1/oauth-apps.get?AppId=zapier
X-Auth-Token: <user_token>
X-User-Id: <user_id>

Example Response:

The response contains internal configuration details of OAuth apps set up in the instance, including credentials that should only be accessible by admins.

Vulnerable File and Code Location

Affected File:
apps/meteor/app/api/server/v1/oauthapps.ts

Relevant Code Block (lines 25–45):

Issue:
The code above requires the user to be authenticated (authRequired: true) but does not perform any authorization or permission checks such as hasPermissionAsync(). As a result, any authenticated user, regardless of role, can access this endpoint and retrieve sensitive configuration data.

Additional Information

Affected Versions: Rocket.Chat ≤ 6.12.0

Impact

Disclosure of client_id and client_secret could lead to further compromise of third-party integrated services.

Violation of the principle of least privilege: users without administrative roles gain access to configuration data they are not authorized to see.

Potential compliance issues depending on how OAuth integrations are used (e.g., exposing keys to cloud identity providers).