lunary-ai lunary up to 1.2.6 Web UI access control

Summaryinfo

A vulnerability has been found in lunary-ai lunary up to 1.2.6 and classified as critical. Impacted is an unknown function of the component Web UI. The manipulation leads to access control. This vulnerability is uniquely identified as CVE-2024-1666. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in lunary-ai lunary up to 1.2.6. It has been rated as critical. This issue affects an unknown part of the component Web UI. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.

The advisory is shared at huntr.com. The identification of this vulnerability is CVE-2024-1666 since 02/20/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.2.7 eliminates this vulnerability. Applying the patch c57cd50fa0477fd2a2efe60810c0099eebd66f54 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• lunary-ai

Name

• lunary

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6

License

• open-source

Website

• Product: https://github.com/lunary-ai/lunary/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion