CVE-2024-5478: Lunary SAML Metadata XSS Vulnerability

CVE-2024-5478 Overview

CVE-2024-5478 is a reflected Cross-Site Scripting (XSS) vulnerability in lunary-ai/lunary version 1.2.7. The flaw affects the SAML metadata endpoint at /auth/saml/${org?.id}/metadata. The application embeds the user-supplied orgId path parameter directly into an XML response without escaping or validating the input. An attacker can craft a malicious URL that injects arbitrary JavaScript into the generated SAML metadata document. Successful exploitation can lead to session cookie theft, authentication token exfiltration, or actions performed in the victim's browser context. The issue is tracked under CWE-79 and was reported through the Huntr bug bounty program.

Critical Impact
An attacker can execute arbitrary JavaScript in a victim's browser by delivering a crafted SAML metadata URL, enabling theft of session cookies and authentication tokens.

Affected Products

lunary-ai/lunary version 1.2.7
SAML authentication component at /auth/saml/${org?.id}/metadata
Deployments exposing the Lunary SAML metadata endpoint to untrusted users

Discovery Timeline

2024-06-06 - CVE-2024-5478 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-5478

Vulnerability Analysis

The vulnerability resides in the SAML metadata handler that generates XML responses for the identity provider configuration flow. The route accepts an orgId value from the URL path and inserts it into the XML response body without output encoding. Because browsers render XML documents containing script-capable content, injected markup executes when a victim visits a crafted link. The scope changes from vulnerable component to browser origin, so an attacker can pivot into authenticated Lunary sessions if the victim is logged in.

Exploitation requires user interaction — a victim must load the malicious URL — but no authentication or elevated privileges are needed to craft the payload. The endpoint is reachable over the network, making phishing and social engineering viable delivery mechanisms.

Root Cause

The root cause is missing input validation and missing output encoding on the orgId path parameter. The handler treats the parameter as trusted string data and concatenates it into an XML template. Neither XML entity encoding nor allow-list validation is applied. Any characters that terminate the XML context, such as angle brackets or attribute quotes, break out of the intended data location and introduce attacker-controlled markup.

Attack Vector

An attacker constructs a URL of the form /auth/saml/<payload>/metadata where <payload> contains XML or HTML that carries JavaScript. The attacker distributes the link through phishing email, chat, or a third-party site. When a victim who is authenticated to Lunary opens the link, the injected script runs under the Lunary origin. The script can read cookies not marked HttpOnly, exfiltrate bearer tokens held in browser storage, and issue authenticated requests against the Lunary API on behalf of the victim.

No verified proof-of-concept code is published for this CVE. See the Huntr Bounty Report for reporter-supplied technical detail.

Detection Methods for CVE-2024-5478

Indicators of Compromise

Requests to /auth/saml/*/metadata containing URL-encoded angle brackets, script tokens, javascript: schemes, or on*= event handler substrings in the orgId segment.
Web server access logs showing unusually long or non-UUID orgId values on the SAML metadata route.
Outbound requests from client browsers to unfamiliar domains immediately after loading a SAML metadata URL.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the SAML metadata path and blocks non-alphanumeric characters in the orgId segment.
Add server-side logging that records the raw orgId value and alerts when it fails a strict UUID or slug regex.
Review browser Content Security Policy (CSP) violation reports for script-src blocks originating from /auth/saml/ responses.

Monitoring Recommendations

Correlate SAML metadata requests with subsequent authenticated API calls from the same session to identify token abuse.
Baseline normal orgId formats and alert on deviations, focusing on requests carrying reserved XML characters.
Track referrer headers on hits to /auth/saml/*/metadata to identify externally hosted lure pages.

How to Mitigate CVE-2024-5478

Immediate Actions Required

Upgrade lunary-ai/lunary beyond version 1.2.7 to a release that validates and encodes the orgId parameter.
Restrict access to the SAML metadata endpoint to trusted networks or authenticated administrators where feasible.
Rotate any session cookies and API tokens issued to users who may have followed suspicious SAML metadata URLs.

Patch Information

Refer to the Huntr Bounty Report for maintainer response and remediation status. Track the upstream lunary-ai/lunary repository for a fixed release incorporating input validation on the orgId route parameter and XML entity encoding on the metadata response.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on responses served from /auth/saml/.
Configure a reverse proxy or WAF to reject requests where the orgId path segment does not match a UUID pattern such as ^[0-9a-f-]{36}$.
Mark session cookies as HttpOnly and Secure, and store authentication tokens outside of JavaScript-accessible storage.

bash

# Example NGINX guard for the SAML metadata route
location ~ ^/auth/saml/(?<org>[^/]+)/metadata$ {
    if ($org !~ "^[0-9a-fA-F-]{36}$") { return 400; }
    proxy_pass http://lunary_upstream;
}