PT-2024-18211 · Lunary Ai · Lunary

Published 2024-04-15 · Updated 2025-01-10 · CVE-2024-1666

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.0.0

Description The issue is related to an authorization flaw that allows unauthorized radar creation. This flaw stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.

Recommendations For lunary-ai/lunary version 1.0.0, consider disabling the radar creation feature until a patch is available to prevent unauthorized radar creation. Restrict access to the server-side radar creation API to minimize the risk of exploitation. Avoid using the radar creation process directly; instead, use the web UI, which enforces account checks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-1666

Affected Products

Lunary

References · 7

• 🔥 https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54 · Exploit
• 🔥 https://huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1666 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1666 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1780114561535812029 · Twitter Post
• https://twitter.com/CVEnew/status/1780039224194146450 · Twitter Post
• https://t.me/cvenotify/107027 · Telegram Post