CVE-2025-0281

Executive Summary

CVE-2025-0281 is a stored cross-site scripting (XSS) vulnerability in lunary-ai/lunary versions 1.6.7 and earlier. An attacker can inject malicious JavaScript into the SAML IdP XML metadata, which is then used to generate the SAML login redirect URL. This URL is set as the value of window.location.href without proper validation or sanitization, allowing arbitrary JavaScript execution in the context of the user's browser. This can lead to session hijacking, data theft, or other malicious actions. The vulnerability is fixed in version 1.7.10.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary package, which is an open-source project available on GitHub. The package is not distributed via NPM, PyPI, Go, or Ruby registries, but is directly used from the GitHub repository. Users should ensure they are using version 1.7.10 or later to mitigate this vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated High due to the potential for session hijacking and data theft, despite requiring user interaction.

Deep Dive & Mechanics

The vulnerability resides in the SAML authentication flow of lunary. When a user initiates SAML-based login, the application fetches XML metadata from the Identity Provider (IdP). This metadata is parsed to extract the redirect URL for authentication. However, the application does not properly validate or sanitize the metadata content. An attacker can craft malicious SAML IdP XML metadata containing JavaScript code. When the application processes this metadata, it constructs a redirect URL that includes the malicious JavaScript. This URL is then assigned to window.location.href, causing the browser to execute the injected script.

The attack flow:

1. Attacker registers a malicious SAML IdP or compromises an existing one.
2. Attacker crafts XML metadata with embedded JavaScript in the redirect URL field.
3. User initiates SAML login via lunary.
4. Lunary fetches the malicious metadata and constructs the redirect URL.
5. The URL is set to window.location.href, executing the attacker's script.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.6.7):

// Vulnerable: No sanitization of SAML metadata
const metadata = await fetchIdPMetadata(idpUrl);
const redirectUrl = extractRedirectUrl(metadata);
window.location.href = redirectUrl;

Patched Code (version 1.7.10):

// Patched: Sanitize the redirect URL
const metadata = await fetchIdPMetadata(idpUrl);
const redirectUrl = extractRedirectUrl(metadata);
const sanitizedUrl = sanitizeUrl(redirectUrl); // New sanitization function
window.location.href = sanitizedUrl;

The patch introduces a sanitizeUrl function that validates the URL against a whitelist of allowed schemes and domains, and strips any JavaScript code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A lunary instance running version 1.6.7 or earlier.
• Ability to host a malicious SAML IdP or modify an existing one.

Exploit Steps:

1. Set up a malicious SAML IdP that returns crafted XML metadata.
2. The metadata should contain a redirect URL with embedded JavaScript, e.g.:

   <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="javascript:alert('XSS')"/>
   

3. Trick a user into initiating SAML login via the compromised IdP.
4. The user's browser executes the injected JavaScript.

Proof of Concept:

// Simulate the vulnerable behavior
const maliciousMetadata = `
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
  <IDPSSODescriptor>
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="javascript:alert('XSS')"/>
  </IDPSSODescriptor>
</EntityDescriptor>`;
const redirectUrl = extractRedirectUrl(maliciousMetadata);
window.location.href = redirectUrl; // Executes the JavaScript

Blue Team

Detection Steps:

1. Monitor for unusual SAML IdP metadata containing javascript: or other suspicious schemes in the Location attribute.
2. Implement input validation for all SAML metadata fields.
3. Use Content Security Policy (CSP) headers to restrict script execution.
4. Regularly update lunary to the latest version.

Lab Setup:

• Use a test environment with lunary 1.6.7.
• Set up a simple SAML IdP using tools like saml-idp or keycloak.
• Monitor network traffic and browser console for XSS execution.

Indicators of Compromise (IOCs)

• Network: SAML metadata containing javascript: or data: schemes in the Location attribute.
• Logs: Unusual redirect URLs in SAML authentication logs.
• Browser: Unexpected JavaScript execution during SAML login.
• File: Modified SAML IdP metadata files with embedded scripts.

Detection Engineering

YARA Rule

rule CVE_2025_0281_SAML_XSS {
    meta:
        description = "Detects malicious SAML metadata with XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-0281"
    strings:
        $s1 = "javascript:" nocase
        $s2 = "data:" nocase
        $s3 = "vbscript:" nocase
        $s4 = "onload=" nocase
        $s5 = "onerror=" nocase
    condition:
        any of ($s*) and #saml_metadata > 0
}

Sigma Rule

title: CVE-2025-0281 SAML XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SAML metadata with suspicious redirect URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: lunary
detection:
    selection:
        - metadata|contains: 'javascript:'
        - metadata|contains: 'data:'
        - metadata|contains: 'vbscript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in metadata (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0281 SAML XSS Attempt"; flow:to_server; content:"javascript:"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade lunary to version 1.7.10 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block SAML metadata containing javascript: or data: schemes.
3. Validate and sanitize all SAML IdP metadata before processing.

Long-term Measures:

1. Implement strict input validation for all external data.
2. Use Content Security Policy (CSP) headers to mitigate XSS.
3. Regularly audit and update dependencies.
4. Monitor for unusual SAML authentication patterns.

Workarounds:

• Disable SAML authentication until the patch is applied.
• Use a proxy to inspect and sanitize SAML metadata.

Valters IT