Rocket.Chat Open Redirect Vulnerability

An open redirect vulnerability exists in Rocket.Chat versions prior to 8.4.0. The issue arises in the SAML single logout redirect endpoint, which improperly validates redirect URLs before using them in a 302 response. This flaw allows unauthenticated users to be redirected to arbitrary external sites, potentially leading to phishing attacks or other malicious activities.

Impact

Exploitation of this vulnerability could result in unauthorized redirection of users to external websites, which could be used for phishing or other malicious purposes.

Remediation

Users can upgrade to Rocket.Chat version 8.4.0 or later to address this vulnerability.