Citrix Gateway: Error „Relay State in Response does not match with rule in Action

CITRIX GATEWAY: ERROR „RELAY STATE IN RESPONSE DOES NOT MATCH WITH RULE IN ACTION

With the latest Citrix ADC firmware a feature was implemented to validate the relay state of an incoming SAML request at Citrix ADC. In order to mitigate the potential risk from CVE 2020-8300, customers should implement this check after upgrading the firmware to 13.0-82.42 / 12.1-62.25, as recommended in https://support.citrix.com/article/CTX316577

This is working fine, as long as a user browses the main URL, like https://gateway.example.com

From the field we know, a lot of people have bookmarks and want to use them to re-login. Since the steps from the article above are strictly checking for the Relay state https://gateway.example.com/, it would not work if the bookmark links to https://gateway.example.com/Citrix/SAMLweb or some other deep-links, I guess. You will receive this error message:

Citrix confirms the behavior in https://support.citrix.com/article/CTX319685 After some research and analyzing the SAML relay state (with SAML panel for Chrome), I extracted the relay state from the response and extracted those with https://www.base64decode.org/

Just copy the content of relaystate and copy it to decode input field:

Here we can see there is nothing to identify the hostname in the encoded content.

From this point, we have to extend the ruleset, with the following:

AAA.LOGIN.RELAYSTATE.EQ("https://gateway.example.com/") 
|| (AAA.LOGIN.RELAYSTATE.LENGTH.EQ(0) && HTTP.REQ.HOSTNAME.EQ("gateway.example.com"))

With the second part of the expression you can ensure, that the relaystate is empty (length = 0), but the requested hostname is equal to the expected relay. From a security perspective this should meet everything to mitigate the vulnerability CVE 2020-8300