PT-2024-37377 · Lunary · Lunary

Published 2024-09-13 · Updated 2024-09-19 · CVE-2024-6087

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 844e8855c7a713dc7371766dba4125de4007b1cf

Description: An improper access control issue exists, allowing attackers to use auth tokens from the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover.

Recommendations: For versions prior to commit 844e8855c7a713dc7371766dba4125de4007b1cf, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the 'invite user' functionality until a patch is available. Avoid using the auth tokens issued by this functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2024-6087

GHSA-6P2Q-8QFQ-WQ7X

Affected Products

Lunary

References · 10

• 🔥 https://huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8 · Exploit
• https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf · Patch
• https://osv.dev/vulnerability/CVE-2024-6087 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p2q-8qfq-wq7x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6087 · Security Note
• https://github.com/lunary-ai/lunary · Note
• https://twitter.com/CVEnew/status/1834633838276018268 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834664551771422724 · Twitter Post
• https://t.me/cvenotify/94628 · Telegram Post
• https://t.me/cvedetector/5623 · Telegram Post