PT-2024-37091 · Lunary Ai · Lunary
Published
2024-06-27
·
Updated
2024-09-19
·
CVE-2024-5714
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
lunary-ai/lunary version 1.2.4
Description:
The issue is caused by an improper access control vulnerability that allows members with team management permissions to manipulate project identifiers in requests. This enables them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. The vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (
org id should be orgId) that prevents proper user organization validation. Attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests.Recommendations:
For lunary-ai/lunary version 1.2.4, consider disabling the handling of project IDs in requests for user invitation and modification API endpoints until a patch is available. Restrict access to the backend API endpoints for user invitation and modification to minimize the risk of exploitation. Avoid using the
org id attribute in requests until the issue is resolved, and ensure that the correct attribute naming (orgId) is used for proper user organization validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Access Control
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Lunary