PT-2024-38366 · Lunary Ai · Lunary

Hughcrt · Published 2024-11-01 · Updated 2024-11-06 · CVE-2024-7456

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.2

Description A SQL injection vulnerability exists in the "/api/v1/external-users" route. The order by clause of the SQL query uses sql.unsafe without prior sanitization, allowing for SQL injection. The orderByClause variable is constructed without server-side validation or sanitization, enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.

Recommendations For lunary-ai/lunary version v1.4.2, as a temporary workaround, consider disabling the /api/v1/external-users route until a patch is available. Restrict access to this route to minimize the risk of exploitation. Avoid using the orderByClause variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7456

Affected Products

Lunary

References · 10

• 🔥 https://huntr.com/bounties/bfb3015e-5642-4d94-ab49-e8b49c4e07e4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7456 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7456 · Vendor Advisory
• https://github.com/lunary-ai/lunary/commit/6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e · Note
• https://t.me/cvedetector/9576 · Telegram Post
• https://twitter.com/oktsec/status/1852359395264307319 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1852362629630529618 · Twitter Post
• https://twitter.com/CveFindCom/status/1852327619460563194 · Twitter Post
• https://t.me/cvenotify/100270 · Telegram Post
• https://twitter.com/CVEnew/status/1852327225460187557 · Twitter Post