[Security Vulnerability Rocket.chat] HTML Injection into Email via Signup

**Description** Due to a lack of&nbsp;&nbsp;sanitization&nbsp;and validation in parameter affected, we can input&nbsp;HTML&nbsp;Tag and system will render it into Email victim.&nbsp; **Affected Endpoint** [https://chat.oas.greenhost.net/home](https://chat.oas.greenhost.net/home)&nbsp;&nbsp; Parameter : Name **Step to produce**  In textbox name, input HTML code like _"\>\<img src=[https://www.no-gods-no-masters.com/images\_designs/anonymous-gandhi-d001001207265.png](https://www.no-gods-no-masters.com/images_designs/anonymous-gandhi-d001001207265.png)\>”@x.y " &nbsp;_ And in Email, input your victim email. Then click Lets Go&nbsp;/ Submit. When victim open email from your system, it will look.&nbsp;&nbsp;   **Impact** - Phising - Abusing other user - Defacing **Fix** Filtering on parameter affected. <font color="#888888"><div><br></div> <div><br></div> <div><br></div> <div><b>Steven Julian</b></div> <div><b><a href="mailto:[email protected]" target="_blank">[email protected]</a> // +62 89658610626</b></div></font> ## Impact - Phising - Abusing other user - Defacing