CVE-2024-7475: Lunary Auth Bypass Vulnerability

CVE-2024-7475 Overview

An improper access control vulnerability exists in lunary-ai/lunary version 1.3.2 that allows an attacker to update the SAML configuration without authorization. This critical security flaw enables manipulation of authentication processes, fraudulent login requests, and theft of user information. The vulnerability stems from missing access controls on the SAML configuration endpoint, allowing unauthenticated users to modify sensitive authentication settings.

Critical Impact
Unauthorized modification of SAML configuration can lead to complete authentication bypass, enabling attackers to forge login credentials, redirect authentication flows, and steal user credentials at scale.

Affected Products

Lunary version 1.3.2 and earlier versions
lunary-ai/lunary open-source LLM observability platform
Self-hosted Lunary deployments with SAML authentication enabled

Discovery Timeline

2024-10-29 - CVE-2024-7475 published to NVD
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-7475

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the affected application fails to perform proper authorization checks before allowing access to sensitive functionality. In the context of Lunary, an LLM observability and monitoring platform, the SAML configuration endpoint accepts modification requests without verifying that the requesting user has administrative privileges.

The attack surface is network-accessible without requiring any authentication or user interaction. An attacker exploiting this vulnerability can achieve high-impact compromise of both confidentiality and integrity by manipulating the SAML Identity Provider (IdP) settings. This allows the attacker to redirect authentication flows to a malicious IdP under their control.

Root Cause

The root cause of CVE-2024-7475 is the absence of authorization middleware or access control checks on the SAML configuration update endpoint. The application fails to validate whether the incoming request originates from an authenticated administrator before processing configuration changes. This represents a fundamental oversight in the security architecture where sensitive administrative functions were exposed without proper role-based access control (RBAC) enforcement.

Attack Vector

The attack vector for this vulnerability is network-based with low complexity. An unauthenticated attacker can send crafted HTTP requests to the SAML configuration endpoint to modify critical authentication parameters.

The exploitation flow typically involves:

The attacker identifies a Lunary instance with SAML authentication configured
Without any authentication, the attacker sends a request to update the SAML configuration
The attacker modifies the IdP URL to point to an attacker-controlled SAML identity provider
Legitimate users attempting to authenticate are redirected to the malicious IdP
The attacker captures user credentials or issues fraudulent SAML assertions to gain unauthorized access

The attack requires no user interaction and can be performed remotely against any exposed Lunary instance running vulnerable versions.

Detection Methods for CVE-2024-7475

Indicators of Compromise

Unexpected modifications to SAML configuration settings in application logs
Authentication redirects to unfamiliar or suspicious Identity Provider URLs
Anomalous login patterns or authentication attempts from unauthorized sources
SAML configuration changes without corresponding administrative audit trail entries

Detection Strategies

Monitor HTTP requests to SAML configuration endpoints for unauthenticated access attempts
Implement alerting on any SAML configuration changes and correlate with authenticated admin sessions
Review application logs for configuration modification events that lack proper authorization context
Deploy web application firewall (WAF) rules to detect and block unauthorized configuration requests

Monitoring Recommendations

Enable comprehensive audit logging for all administrative configuration changes in Lunary
Set up real-time alerts for SAML IdP URL modifications or certificate changes
Monitor authentication flow patterns for sudden redirects to new identity providers
Implement integrity monitoring on configuration files to detect unauthorized changes

How to Mitigate CVE-2024-7475

Immediate Actions Required

Upgrade Lunary to the patched version that includes commit 8f563c77d8614a72980113f530c7a9ec15a5f8d5
Review current SAML configuration settings for any unauthorized modifications
Audit authentication logs for suspicious login activity that may indicate prior exploitation
Consider temporarily disabling SAML authentication until the patch is applied if the environment is at high risk

Patch Information

Lunary has addressed this vulnerability through a security fix available in the GitHub commit. The fix implements proper authorization checks to ensure that SAML configuration modifications can only be performed by authenticated administrators with appropriate privileges.

Organizations using Lunary should update to the latest version that includes this security fix. The vulnerability was reported through the Huntr bug bounty program, and additional technical details are available in the bounty submission.

Workarounds

Restrict network access to the Lunary application to trusted IP addresses only using firewall rules
Place Lunary behind an authentication proxy that requires valid credentials before accessing the application
Implement WAF rules to block unauthenticated requests to administrative endpoints including SAML configuration
If SAML is not required, disable SAML authentication entirely until the patch can be applied

bash

# Example: Restrict access to Lunary using iptables
# Allow only trusted admin IP ranges to access the application
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP