PT-2024-29440 · Lunary Ai · Lunary

Published 2024-05-21 · Updated 2025-01-31 · CVE-2024-4154

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.2

Description The issue allows unprivileged users to rename projects they do not have access to by sending a PATCH request to the project's endpoint with a new name, despite lacking necessary permissions or assignment to the project. This can lead to unauthorized modification of project names, potentially causing confusion or unauthorized access to project resources.

Recommendations For lunary-ai/lunary version 1.2.2, consider restricting access to the project's endpoint to prevent unauthorized renaming of projects until a patch is available. As a temporary workaround, limit the ability of unprivileged users to send PATCH requests to project endpoints.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-821

CWE-639

Related Identifiers

CVE-2024-4154

Affected Products

Lunary

References · 8

• 🔥 https://huntr.com/bounties/e56509af-f7af-4e1e-a04b-9cb53545f30f · Exploit
• https://osv.dev/vulnerability/CVE-2024-4154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4154 · Security Note
• https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7 · Note
• https://t.me/cvenotify/80679 · Telegram Post
• https://t.me/cvenotify/80606 · Telegram Post
• https://t.me/cvenotify/107040 · Telegram Post
• https://t.me/cvenotify/109386 · Telegram Post