PT-2024-9679 · Lunary · Lunary

Published 2024-10-29 · Updated 2025-01-09 · CVE-2024-7474

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.3.2

Description The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability, which allows unauthorized access to external user data by manipulating the id parameter in the request URL. This can enable a remote attacker to impact the integrity and confidentiality of protected information. The application fails to perform adequate checks on the id parameter, allowing users to view or delete external users.

Recommendations For version 1.3.2, consider restricting access to the id parameter in the request URL to prevent unauthorized access to external user data. As a temporary workaround, restrict the ability to manipulate the id parameter until a patch is available. Additionally, ensure that adequate checks are performed on the id parameter to prevent IDOR vulnerabilities.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2024-11391

CVE-2024-7474

Affected Products

Lunary

References · 11

• 🔥 https://huntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871 · Exploit
• https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5 · Patch
• https://bdu.fstec.ru/vul/2024-11391 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7474 · Security Note
• https://twitter.com/CCBalert/status/1852009091314467058 · Twitter Post
• https://t.me/cvedetector/9317 · Telegram Post
• https://twitter.com/transilienceai/status/1854935962549469278 · Twitter Post
• https://twitter.com/transilienceai/status/1855661350619656234 · Twitter Post
• https://t.me/cvenotify/101686 · Telegram Post
• https://t.me/cvenotify/100502 · Telegram Post