PT-2025-12259 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9000

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions prior to 1.4.26

Description The issue concerns a lack of access control in the checklists.post() endpoint, allowing users to create or modify checklists without proper permission checks. This enables unauthorized users to create checklists, bypassing intended permissions. Furthermore, the endpoint fails to validate the uniqueness of the slug field when creating a new checklist, permitting an attacker to spoof existing checklists by reusing the slug of an already-existing checklist. This can lead to significant data integrity issues, as legitimate checklists can be replaced with malicious or altered data.

Recommendations For versions prior to 1.4.26, update to version 1.4.26 or later to resolve the issue. As a temporary workaround, consider disabling the checklists.post() endpoint until a patch is available. Restrict access to the checklists.post() endpoint to minimize the risk of exploitation. Avoid using the slug field in the affected endpoint until the issue is resolved.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2024-9000

Affected Products

Lunary

References · 5

• 🔥 https://huntr.com/bounties/f5fca549-0a4a-4f64-8ccf-d4e108856da4 · Exploit
• https://github.com/lunary-ai/lunary/commit/a02861ef9bb6ce860a35f7b8f178d58859cd85f0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9000 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9000 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902968904286343517 · Twitter Post