PT-2024-18160 · Unknown · Lunary-Ai/Lunary
Published
2024-04-10
·
Updated
2024-06-07
·
CVE-2024-1599
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
lunary-ai/lunary version 0.3.0
Description
The issue is related to insufficient server-side validation of user account types during project creation, allowing unauthorized project creation. Specifically, in the free account tier, users are limited to creating only two projects, but this restriction is only enforced in the web UI, not on the server side. This enables users to bypass the limitation and create an unlimited number of projects without upgrading their account or incurring additional charges. The vulnerability is due to the lack of checks in the project creation endpoint.
Recommendations
For lunary-ai/lunary version 0.3.0, consider disabling the project creation endpoint until a patch is available to enforce server-side validation of user account types. Restrict access to the project creation functionality to minimize the risk of exploitation. Avoid using the free account tier for critical projects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Lunary-Ai/Lunary