An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information. Appropriate access controls should be implemented to ensure that the SAML configuration can only be updated by authorized users.
The vulnerability results from improper implementation of access control mechanism (CWE-862 — missing required authorization). The endpoint that enables SAML configuration updates does not verify whether the request comes from an authorized user. As a result, any attacker with network access can send a request to modify the SAML configuration without needing to possess any credentials. This allows for substituting a malicious identity provider (IdP) or manipulating authentication parameters.
An attacker can manipulate the authentication process, generate false login requests, and steal user information. In extreme cases, it is possible to completely take over the SAML-based login mechanism and gain unauthorized access to user accounts.
Update Lunary to the version containing the fix available in the GitHub repository (commit 8f563c77d8614a72980113f530c7a9ec15a5f8d5). Apply patches available from the vendor according to the references and ensure that the SAML configuration update endpoint is available only to authorized administrators.
Lunary (lunary-ai/lunary) version 1.3.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NLunary
APPLunary< 1.3.4
Related vulnerabilities
Stored XSS w Lunary — wstrzyknięcie skryptu przez zmienną środowiskową
Brak kontroli dostępu w API BigQuery — eksport całej bazy danych w Lunary
SQL Injection w trasie /api/v1/external-users aplikacji Lunary
Błąd autoryzacji w Lunary umożliwiający pełny dostęp do projektów
SSRF w Lunary – nieautoryzowane żądania przez endpoint SAML IdP