PT-2024-18266 · Lunary Ai · Lunary

Published 2024-04-10 · Updated 2025-01-31 · CVE-2024-1741

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.0.1

Description The issue allows removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This exposes organizations to unauthorized access and manipulation of sensitive template data.

Recommendations For lunary-ai/lunary version 1.0.1, consider disabling the use of old authorization tokens to prevent removed members from accessing prompt templates until a patch is available. Restrict access to prompt template operations to minimize the risk of exploitation. Avoid using previously captured authorization tokens in HTTP requests to the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2024-1741

Affected Products

Lunary

References · 9

• 🔥 https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b · Exploit
• https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-1741 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1741 · Vendor Advisory
• https://twitter.com/CVEnew/status/1778118887231418802 · Twitter Post
• https://t.me/cvenotify/109383 · Telegram Post
• https://t.me/cvenotify/76308 · Telegram Post
• https://t.me/cvenotify/107024 · Telegram Post
• https://t.me/cvenotify/76821 · Telegram Post