CVE-2024-5328

The vulnerability results from the lack of validation of URLs supplied by the user before their use in server-side requests. The attacker sends a specially crafted request to the endpoint responsible for retrieving the XML configuration file of the identity provider (IdP) as part of SAML integration. The server, without verification, executes an HTTP request to the address specified by the attacker, allowing access to resources that are not directly accessible from the outside – including internal network services, cloud environment metadata, and other infrastructure components.

An attacker can gain access to sensitive information from internal infrastructure (e.g., cloud instance metadata, access tokens, service configurations), cause service disruptions, or prepare the ground for further attacks on the internal network (lateral movement).

Patches available from the vendor should be applied according to the references. It is also recommended to implement URL validation and filtering on the server side (allowlisting of permitted hosts) and restrict outgoing network connections from the application server to the required minimum.

The latest version of the Lunary application (lunary-ai/lunary) available at the time of vulnerability report – versions indicated in the vendor's references.