PT-2024-18177 · Lunary Ai · Lunary

Published 2024-04-15 · Updated 2025-01-31 · CVE-2024-1626

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 0.3.0

Description An Insecure Direct Object Reference (IDOR) vulnerability exists in the project update endpoint, allowing authenticated users to modify the name of any project within the system without proper authorization checks. This is achieved by directly referencing the project's ID in the PATCH request to the "/v1/projects/:projectId" endpoint. The issue arises because the endpoint does not verify if the provided project ID belongs to the currently authenticated user, enabling unauthorized modifications across different organizational projects.

Recommendations For version 0.3.0, as a temporary workaround, consider restricting access to the "/v1/projects/:projectId" endpoint until a patch is available. Additionally, restrict the use of the :projectId variable in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

CWE-250

Related Identifiers

CVE-2024-1626

Affected Products

Lunary

References · 8

• 🔥 https://huntr.com/bounties/ccc291db-ae9c-403c-b6b5-6fe3f4800933 · Exploit
• https://github.com/lunary-ai/lunary/commit/9eb9e526edff8bf82ae032f7a04867c8d58572bc · Patch
• https://osv.dev/vulnerability/CVE-2024-1626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1626 · Security Note
• https://t.me/cvenotify/107026 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780113802974863374 · Twitter Post
• https://t.me/cvenotify/109384 · Telegram Post
• https://twitter.com/CVEnew/status/1780039213343506760 · Twitter Post