PT-2024-34599 · Lunary Ai · Lunary

Published 2024-06-06 · Updated 2024-10-17 · CVE-2024-5133

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.4

Description An account takeover issue exists due to the exposure of password recovery tokens in API responses. When a user initiates the password reset process, the recovery token is included in the response of the "GET /v1/users/me/org" endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the recovery token attribute in the users object returned by the API.

Recommendations For lunary-ai/lunary version 1.2.4, as a temporary workaround, consider disabling the GET /v1/users/me/org endpoint until a patch is available. Restrict access to the recovery token attribute in the users object returned by the API to minimize the risk of exploitation. Avoid using the recovery token attribute in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-5133

Affected Products

Lunary

References · 7

• 🔥 https://huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b · Exploit
• https://osv.dev/vulnerability/CVE-2024-5133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5133 · Security Note
• https://twitter.com/CveFindCom/status/1798784707393466718 · Twitter Post
• https://t.me/cvenotify/98563 · Telegram Post
• https://twitter.com/CVEnew/status/1798786696081006971 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1798817482502758877 · Twitter Post