PT-2024-26293 · Lunary Ai · Lunary

Published 2024-11-14 · Updated 2025-01-30 · CVE-2024-3502

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.5

Description An information disclosure issue exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This occurs when authenticated users inspect responses from "GET /v1/users/me" and "GET /v1/users/me/org" endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities.

Recommendations For lunary-ai/lunary versions up to and including 1.2.5, upgrade to version 1.2.6 to address the issue. As a temporary workaround, consider restricting access to the "GET /v1/users/me" and "GET /v1/users/me/org" endpoints until the issue is resolved.

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-201

CWE-200

CWE-922

Related Identifiers

CVE-2024-3502

Affected Products

Lunary

References · 8

• https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74 · Patch
• https://huntr.com/bounties/c2aff952-2dec-4538-8905-190c484aae94 · Patch
• https://osv.dev/vulnerability/CVE-2024-3502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3502 · Security Note
• https://twitter.com/CveFindCom/status/1857121948985115031 · Twitter Post
• https://t.me/cvenotify/109148 · Telegram Post
• https://twitter.com/CVEnew/status/1857119163761750439 · Twitter Post
• https://t.me/cvenotify/102061 · Telegram Post