CVE-2024-5328 SSRF Vulnerability in lunary-ai/lunary

High 8.6 Published 6 Jun 2024 Updated 1 Aug 2024

An attacker can exploit an SSRF vulnerability in the Lunary AI application to access internal resources or disrupt services via unvalidated URL inputs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-5328?

CVE-2024-5328 is a high-severity server-side request forgery vulnerability in Lunary Lunary, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xml'. The vulnerability arises due to the application's failure to validate user-supplied URLs before using them in server-side requests. An attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoint, allowing them to make unauthorized requests to internal or external resources. This could lead to the disclosure of sensitive information, service disruption, or further attacks against the network infrastructure. The issue affects the latest version of the application as of the report.

Weakness: CWE-918

Which versions are affected by CVE-2024-5328?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-5328?

No fix has been published for CVE-2024-5328 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-5328 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5328 exists.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-fmgc-qjr6-w2jp.