Executive Summary

This vulnerability affects Rocket.Chat's SAML integration in versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. The issue is that the system does not verify the signature on inbound LogoutRequest messages.

An unauthenticated remote attacker who knows a target user's SAML NameID (which is typically the user's email address exposed by major identity providers like Okta, Google Workspace, Microsoft Entra ID, and JumpCloud) can craft a valid-looking but unsigned LogoutRequest and send it to the service provider's logout endpoint.

The server mistakenly processes this unsigned LogoutRequest as legitimate and immediately destroys the victim's session without any authentication or victim interaction.

This attack can be repeated continuously against individual users or scripted across many accounts, effectively making the Rocket.Chat instance unusable for users authenticated via SAML.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to forcibly log out users by destroying their sessions without their consent or knowledge.

Because the attack requires no authentication and no user interaction, it can be automated and repeated in a loop against individual users or many users at once.

The practical impact is a denial of service for SAML-authenticated users, rendering the Rocket.Chat platform effectively unusable for them.

Useful 0 Not Useful 0