PT-2025-12268 · Unknown · Lunary-Ai/Lunary

Published 2025-03-20 · Updated 2025-04-10 · CVE-2024-9099

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.29

Description The GET "/projects" API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This issue allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.

Recommendations For version v1.4.29, consider restricting access to the GET "/projects" API endpoint to prevent unauthorized users from retrieving sensitive credentials. As a temporary workaround, restrict the use of the developer tools to minimize the risk of exploitation. Avoid using the API endpoint from the frontend until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2024-9099

Affected Products

Lunary-Ai/Lunary

References · 6

• 🔥 https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1c93e91 · Exploit
• https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc · Patch
• https://osv.dev/vulnerability/CVE-2024-9099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9099 · Security Note
• https://twitter.com/CVEnew/status/1902671090041946278 · Twitter Post
• https://t.me/cvenotify/118667 · Telegram Post