PT-2024-35320 · Lunary Ai · Lunary

Hughcrt · Published 2024-06-06 · Updated 2024-11-03 · CVE-2024-5248

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.5

Description An improper access control issue exists due to a missing permission check in the "GET /v1/users/me/org" endpoint. The platform's role definitions restrict the Prompt Editor role to prompt management and project viewing/listing capabilities, excluding access to user information. However, the endpoint fails to enforce this restriction, allowing users with the Prompt Editor role to access the full list of users in the organization. This issue allows unauthorized access to sensitive user information, violating intended access controls.

Recommendations For lunary-ai/lunary version 1.2.5, as a temporary workaround, consider restricting access to the "GET /v1/users/me/org" endpoint until a patch is available. Additionally, review and enforce role definitions to prevent unauthorized access to sensitive user information. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5248

Affected Products

Lunary

References · 7

• 🔥 https://huntr.com/bounties/4ec75087-5630-4813-952b-88ccabe6d117 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5248 · Security Note
• https://github.com/lunary-ai/lunary/commit/7f24ec1c3588992a07fd70573c43a0897eb523a2 · Note
• https://twitter.com/VulmonFeeds/status/1798823058678874548 · Twitter Post
• https://twitter.com/CVEnew/status/1798795455750435227 · Twitter Post
• https://t.me/cvenotify/98667 · Telegram Post