PT-2024-18176 · Lunary Ai · Lunary

Published 2024-04-10 · Updated 2025-01-30 · CVE-2024-1625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 0.3.0

Description An Insecure Direct Object Reference (IDOR) vulnerability exists, allowing unauthorized deletion of any organization's project. The issue is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project ID. This issue affects the project deletion functionality implemented in the "projects.delete" route.

Recommendations For version 0.3.0, consider disabling the project deletion functionality in the "projects.delete" route until a patch is available. Restrict access to the project deletion endpoint to minimize the risk of exploitation. Avoid using the project ID in the affected endpoint until the issue is resolved.

Exploit

Fix

Incorrect Authorization

IDOR

Weakness Enumeration

CWE-863

CWE-639

Related Identifiers

CVE-2024-1625

Affected Products

Lunary

References · 7

• 🔥 https://huntr.com/bounties/cf6dd625-e6c9-44df-a072-13686816de21 · Exploit
• https://github.com/lunary-ai/lunary/commit/88f98e29f19da9d1f5de45c5b163fd5b48e0bcec · Patch
• https://osv.dev/vulnerability/CVE-2024-1625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1625 · Security Note
• https://t.me/cvenotify/76304 · Telegram Post
• https://twitter.com/CVEnew/status/1778118902897099235 · Twitter Post
• https://t.me/cvenotify/109145 · Telegram Post