CyberRota Analysis
AI-GeneratedRocket.Chat's SAML SSO implementation prior to specified versions is vulnerable due to a failure to properly bind validated XML signatures to the samlp:Response or saml:Assertion, allowing attackers to exploit this flaw. By submitting a wrapped document with forged identity attributes, an attacker can authenticate as any user, leading to unauthorized access. Organizations using affected versions should prioritize patching this vulnerability to prevent potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Related CVEs
Other vulnerabilities affecting the same vendor(s)