Cross-site Scripting (XSS) in SAML metadata endpoint in lunary-ai/lunary

Vulnerability

A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint /auth/saml/${org?.id}/metadata of lunary-ai/lunary version 1.2.7. The flaw arises because the application fails to escape or validate the orgId parameter before incorporating it into the generated XML response. This allows an attacker to inject arbitrary JavaScript code into the SAML metadata page [1][2].

Exploitation

An attacker can craft a malicious orgId parameter containing JavaScript code. When a user visits the affected endpoint with the crafted parameter, the script executes in the context of the SAML metadata page. No authentication is required to trigger the vulnerability, as the attacker only needs to trick a victim into clicking a specially crafted link [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to theft of user cookies or authentication tokens, potentially resulting in account takeover or unauthorized access [2].

Mitigation

The vendor has addressed this issue in a subsequent release. Users should upgrade to the latest version of lunary-ai/lunary. No workarounds are available [2].