CVE-2021-22911

Description

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Affected products

Vendor	Product	Affected	Fixed
—	Rocket.Chat server	Fixed in: 3.13.2, 3.12.4, 3.11.4	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 2

Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2) EDB-50108 · webapps · Jul 7, 2021 · verified
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated) EDB-49960 · webapps · Jun 7, 2021 · verified

GitHub 12 repositories · most starred shown

CsEnox/CVE-2021-22911 ★ 61 · Jun 5, 2021

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1
optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911 ★ 10 · Jul 30, 2021

Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911
Faridi-m/CVE-2021-22911-RocketChat ★ 2 · Mar 4, 2026
roshanrajbanshi/rocketcat-cve-2021-22911-exploit ★ 1 · Apr 10, 2026

CVE-2021-22911 Rocket.Chat NoSQL Injection RCE Exploit - Educational Purpose
octodi/CVE-2021-22911 ★ 0 · May 29, 2025

Updated exploit for CVE-2021-22911 (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))
yoohhuu/Rocket-Chat-3.12.1-PoC-CVE-2021-22911- ★ 0 · Dec 26, 2024
overgrowncarrot1/CVE-2021-22911 ★ 0 · Jun 19, 2023
MrDottt/CVE-2021-22911 ★ 0 · Jun 5, 2023
ChrisPritchard/CVE-2021-22911-rust ★ 0 · Apr 1, 2023

exploit for CVE-2021-22911 in rust
jayngng/CVE-2021-22911 ★ 0 · Sep 19, 2021

Modifed ver of the original exploit to save some times on password reseting for unprivileged user

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Rocket.Chat <=3.13 - NoSQL Injection http/cves/2021/CVE-2021-22911.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injecti…