Description:

After getting an auth token via:

curl -d "username=myusername&password=mypassword"
https://rocketchatserver/api/v1/login

any authenticated user can crawl all information about any other user, including the highlighted
keywords, last active time and notification settings with

curl -H "X-Auth-Token: $insert_auth_token_here$"
-H "X-User-Id: $insert_user_id_here$"
https://rocketchatserver/api/v1/users.list

This allows for massive scraping of user data, even if limited to 1 dataset per API call.

Server Setup Information:

• Version of Rocket.Chat Server: 0.63.1
• Operating System: centos 7
• Deployment Method(snap/docker/tar/etc): tar
• Number of Running Instances: 5
• DB Replicaset Oplog: enabled
• Node Version: 8.9.4
• mongoDB Version: 3.4.14

Steps to Reproduce:

1. curl -d "username=myusername&password=mypassword"
   https://open.rocket.chat/api/v1/login
2. curl -H "X-Auth-Token: $insert_auth_token_here$"
   -H "X-User-Id: $insert_user_id_here$"
   https://open.rocket.chat/api/v1/users.list

Expected behavior:

Get the basic user information, for instance name and maybe email address

Actual behavior:

You get user types, roles, notification settings
(all data is from my Rocket.Chat account)
{
„_id": "XXXXXXXXX",
„username“: "*XXXXXX",
"type": "user",
"status": "offline",
"active": true,
„name": "XXXXXXXX",
"ldap": true,
"utcOffset": 2,
"language": "en",
"settings": {
"preferences": {
"newRoomNotification": "door",
"newMessageNotification": "chime",
"emailNotificationMode": "disabled",
"mergeChannels": false,
"roomsListExhibitionMode": "category",
"notificationsSoundVolume": 100,
"desktopNotifications": "all",
"mobileNotifications": "mentions",
"idleTimeLimit": 1800,
"enableAutoAway": false,
"highlights": [
"essen, kuchen, torte"
],
"desktopNotificationDuration": 0,
"viewMode": 0,
"hideUsernames": false,
"hideRoles": false,
"hideAvatars": false,
"hideFlexTab": false,
"sendOnEnter": "normal",
"roomCounterSidebar": false,
"sidebarViewMode": "condensed",
"sidebarShowUnread": true,
"useEmojis": true,
"convertAsciiEmoji": true,
"saveMobileBandwidth": false,
"collapseMediaByDefault": false,
"muteFocusedConversations": true,
"autoImageLoad": true,
"unreadAlert": true,
"language": "en"
},
"profile": {}
},
"statusLivechat": "not-available",
"operator": true
},

Relevant logs:

//No relevant logs, since this is a general API Problem