PT-2024-29439 · Lunary · Lunary
Published
2024-05-22
·
Updated
2024-06-07
·
CVE-2024-4153
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
lunary-ai/lunary version 1.2.2
Description
A vulnerability allows attackers to bypass user creation limits and potentially evade payment requirements. The issue arises from an undefined behavior when handling input to the API, specifically through a POST request to the "/v1/users" endpoint. By crafting a request with a new user's email and assigning them an
admin role, attackers can invite additional users beyond the set limit. This could be exploited to add an unlimited number of users without adhering to the intended restrictions.Recommendations
For version 1.2.2, consider disabling the ability to assign the
admin role to new users until a patch is available. Restrict access to the "/v1/users" endpoint to minimize the risk of exploitation. Avoid using the role parameter in the affected API endpoint until the issue is resolved. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Lunary