PT-2025-12265 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-9095

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.28

Description The issue is related to a lack of proper access control in the /bigquery API route, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database, including sensitive data such as password hashes and secret API keys. The route is protected by a config check (config.DATA WAREHOUSE EXPORTS ALLOWED), but it does not verify the user's access level or implement any access control middleware. This can lead to the extraction of sensitive data, disruption of services, credential compromise, and service integrity breaches.

Recommendations For version v1.4.28, consider disabling the /bigquery API route until proper access control is implemented to prevent unauthorized data exports. Additionally, restrict access to sensitive data such as password hashes and secret API keys to minimize the risk of exploitation. Implement access control middleware to verify the user's access level before allowing them to create a Datastream to Google BigQuery.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2024-9095

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/e242a92e-da41-440d-b718-3de91e4b4eac · Exploit
• https://github.com/lunary-ai/lunary/commit/a8d7b2959e87c30fbafdb12af7ffa093385dcc60 · Patch
• https://osv.dev/vulnerability/CVE-2024-9095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9095 · Security Note
• https://twitter.com/CveFindCom/status/1902670108184731984 · Twitter Post
• https://twitter.com/CVEnew/status/1903336854264615192 · Twitter Post