SAML LogoutRequest Signature Bypass in Rocket.Chat

Executive Summary

This vulnerability affects Rocket.Chat's SAML integration in versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. The issue is that the system does not verify the signature on inbound LogoutRequest messages.

An unauthenticated remote attacker who knows a target user's SAML NameID (which is typically the user's email address exposed by major identity providers like Okta, Google Workspace, Microsoft Entra ID, and JumpCloud) can craft a valid-looking but unsigned LogoutRequest and send it to the service provider's logout endpoint.

The server mistakenly processes this unsigned LogoutRequest as legitimate and immediately destroys the victim's session without any authentication or victim interaction.

This attack can be repeated continuously against individual users or scripted across many accounts, effectively making the Rocket.Chat instance unusable for users authenticated via SAML.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Rocket.Chat instance to one of the fixed versions: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11.

Until the upgrade is applied, be aware that unauthenticated attackers can send unsigned LogoutRequest messages to the service provider logout endpoint, causing user sessions to be destroyed. Monitoring and restricting access to the logout endpoint may help reduce exploitation risk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to forcibly log out users by destroying their sessions without their consent or knowledge.

Because the attack requires no authentication and no user interaction, it can be automated and repeated in a loop against individual users or many users at once.

The practical impact is a denial of service for SAML-authenticated users, rendering the Rocket.Chat platform effectively unusable for them.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsigned SAML LogoutRequest messages being accepted by the Rocket.Chat server. To detect exploitation attempts on your network or system, you should monitor HTTP requests to the Rocket.Chat SAML logout endpoint for LogoutRequest messages that lack valid signatures.

You can use network traffic inspection tools or web server logs to identify suspicious LogoutRequest submissions. For example, inspecting HTTP POST requests to the logout endpoint and analyzing the SAML LogoutRequest XML payload for missing or invalid signatures can help detect potential attacks.

• Use curl or wget to manually send test LogoutRequest messages and observe server responses.
• Use command-line tools like tcpdump or tshark to capture network traffic targeting the logout endpoint.
• Example tshark command to filter HTTP POST requests to the logout endpoint: tshark -Y 'http.request.method == "POST" && http.request.uri contains "/logout"' -T fields -e ip.src -e http.file_data
• Check Rocket.Chat server logs for repeated session terminations or logout events without corresponding user actions.

Useful 0 Not Useful 0