lunary-ai lunary up to 1.0.0 DELETE Request authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in lunary-ai lunary up to 1.0.0. This issue affects some unknown processing of the component DELETE Request Handler. The manipulation results in authorization. This vulnerability is known as CVE-2024-1625. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in lunary-ai lunary up to 1.0.0. Affected is some unknown functionality of the component DELETE Request Handler. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on integrity. CVE summarizes:

An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.

The advisory is shared for download at huntr.com. This vulnerability is traded as CVE-2024-1625 since 02/19/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.0.1 eliminates this vulnerability. Applying the patch 88f98e29f19da9d1f5de45c5b163fd5b48e0bcec is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• lunary-ai

Name

• lunary

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/lunary-ai/lunary/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion