CVE-2024-7475: Lunary Auth Bypass Vulnerability

CVE-2024-7475 Overview

An improper access control vulnerability exists in lunary-ai/lunary version 1.3.2 that allows an attacker to update the SAML configuration without authorization. This critical security flaw enables manipulation of authentication processes, fraudulent login requests, and theft of user information. The vulnerability stems from missing access controls on the SAML configuration endpoint, allowing unauthenticated users to modify sensitive authentication settings.

Critical Impact

Unauthorized modification of SAML configuration can lead to complete authentication bypass, enabling attackers to forge login credentials, redirect authentication flows, and steal user credentials at scale.

Affected Products

• Lunary version 1.3.2 and earlier versions
• lunary-ai/lunary open-source LLM observability platform
• Self-hosted Lunary deployments with SAML authentication enabled

Discovery Timeline

• 2024-10-29 - CVE-2024-7475 published to NVD
• 2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-7475

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the affected application fails to perform proper authorization checks before allowing access to sensitive functionality. In the context of Lunary, an LLM observability and monitoring platform, the SAML configuration endpoint accepts modification requests without verifying that the requesting user has administrative privileges.

The attack surface is network-accessible without requiring any authentication or user interaction. An attacker exploiting this vulnerability can achieve high-impact compromise of both confidentiality and integrity by manipulating the SAML Identity Provider (IdP) settings. This allows the attacker to redirect authentication flows to a malicious IdP under their control.

Root Cause

The root cause of CVE-2024-7475 is the absence of authorization middleware or access control checks on the SAML configuration update endpoint. The application fails to validate whether the incoming request originates from an authenticated administrator before processing configuration changes. This represents a fundamental oversight in the security architecture where sensitive administrative functions were exposed without proper role-based access control (RBAC) enforcement.

Attack Vector

The attack vector for this vulnerability is network-based with low complexity. An unauthenticated attacker can send crafted HTTP requests to the SAML configuration endpoint to modify critical authentication parameters.

The exploitation flow typically involves:

1. The attacker identifies a Lunary instance with SAML authentication configured
2. Without any authentication, the attacker sends a request to update the SAML configuration
3. The attacker modifies the IdP URL to point to an attacker-controlled SAML identity provider
4. Legitimate users attempting to authenticate are redirected to the malicious IdP
5. The attacker captures user credentials or issues fraudulent SAML assertions to gain unauthorized access

The attack requires no user interaction and can be performed remotely against any exposed Lunary instance running vulnerable versions.

Detection Methods for CVE-2024-7475

Indicators of Compromise

• Unexpected modifications to SAML configuration settings in application logs
• Authentication redirects to unfamiliar or suspicious Identity Provider URLs
• Anomalous login patterns or authentication attempts from unauthorized sources
• SAML configuration changes without corresponding administrative audit trail entries

Detection Strategies

• Monitor HTTP requests to SAML configuration endpoints for unauthenticated access attempts
• Implement alerting on any SAML configuration changes and correlate with authenticated admin sessions
• Review application logs for configuration modification events that lack proper authorization context
• Deploy web application firewall (WAF) rules to detect and block unauthorized configuration requests

Monitoring Recommendations

• Enable comprehensive audit logging for all administrative configuration changes in Lunary
• Set up real-time alerts for SAML IdP URL modifications or certificate changes
• Monitor authentication flow patterns for sudden redirects to new identity providers
• Implement integrity monitoring on configuration files to detect unauthorized changes

How to Mitigate CVE-2024-7475

Immediate Actions Required

• Upgrade Lunary to the patched version that includes commit 8f563c77d8614a72980113f530c7a9ec15a5f8d5
• Review current SAML configuration settings for any unauthorized modifications
• Audit authentication logs for suspicious login activity that may indicate prior exploitation
• Consider temporarily disabling SAML authentication until the patch is applied if the environment is at high risk

Patch Information

Lunary has addressed this vulnerability through a security fix available in the GitHub commit. The fix implements proper authorization checks to ensure that SAML configuration modifications can only be performed by authenticated administrators with appropriate privileges.

Organizations using Lunary should update to the latest version that includes this security fix. The vulnerability was reported through the Huntr bug bounty program, and additional technical details are available in the bounty submission.

Workarounds

• Restrict network access to the Lunary application to trusted IP addresses only using firewall rules
• Place Lunary behind an authentication proxy that requires valid credentials before accessing the application
• Implement WAF rules to block unauthenticated requests to administrative endpoints including SAML configuration
• If SAML is not required, disable SAML authentication entirely until the patch can be applied

# Example: Restrict access to Lunary using iptables
# Allow only trusted admin IP ranges to access the application
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP