PT-2024-34586 · Lunary Ai · Lunary

Published 2024-06-06 · Updated 2024-10-03 · CVE-2024-5129

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.2

Description A Privilege Escalation issue exists due to missing authorization checks, allowing any user to delete datasets. The issue is present in the dataset deletion functionality, where the application fails to verify user permissions. Unauthorized users can exploit this by sending a DELETE request to the server and deleting any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.

Recommendations For lunary-ai/lunary version 1.2.2, consider disabling the datasets.delete function until a patch is available to prevent unauthorized dataset deletion. Restrict access to the dataset deletion functionality to minimize the risk of exploitation. Avoid using the dataset ID in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5129

Affected Products

Lunary

References · 7

• 🔥 https://huntr.com/bounties/a6c0deb3-6a4c-4188-8aaa-9e6207f82f44 · Exploit
• https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 · Patch
• https://osv.dev/vulnerability/CVE-2024-5129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5129 · Security Note
• https://twitter.com/CVEnew/status/1798786684768715042 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1798820527731327154 · Twitter Post
• https://twitter.com/CveFindCom/status/1798792227722047854 · Twitter Post