PT-2024-38372 · Lunary · Lunary

Published 2024-10-29 · Updated 2024-10-31 · CVE-2024-7472

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.26

Description The issue allows an unauthenticated attacker to inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character, such as xa0. This can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage. The vulnerability is present in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup).

Recommendations For version 1.2.26, as a temporary workaround, consider disabling the extractFirstName function or restricting the use of whitespace characters in the affected API endpoints until a patch is available. Avoid using the affected API endpoints (/v1/users/send-verification and /auth/signup) for sending verification emails until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-75

CWE-74

CWE-93

Related Identifiers

CVE-2024-7472

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948 · Exploit
• https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd · Patch
• https://osv.dev/vulnerability/CVE-2024-7472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7472 · Security Note
• https://t.me/cvedetector/9315 · Telegram Post
• https://t.me/cvenotify/100216 · Telegram Post