lunary-ai lunary up to 1.2.24 Organization insufficient granularity of access control

Summaryinfo

A vulnerability identified as problematic has been detected in lunary-ai lunary up to 1.2.24. The affected element is an unknown function of the component Organization Handler. This manipulation causes insufficient granularity of access control. This vulnerability appears as CVE-2024-4147. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in lunary-ai lunary up to 1.2.24 and classified as problematic. Affected by this vulnerability is some unknown functionality of the component Organization Handler. The manipulation with an unknown input leads to a insufficient granularity of access control vulnerability. The CWE definition for the vulnerability is CWE-1220. The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. As an impact it is known to affect availability. The summary by CVE is:

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, only checking if the user has permissions to delete such resources without verifying if it belongs to the user's project or organization. As a result, users can remove prompts not owned by their organization or project, leading to legitimate users being unable to access the removed prompts and causing information inconsistencies.

It is possible to read the advisory at huntr.com. This vulnerability is known as CVE-2024-4147 since 04/24/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.2.25 eliminates this vulnerability. Applying the patch 0755dde1afc2a74ec23b55eee03e4416916cf48f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-32706). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• lunary-ai

Name

• lunary

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24

License

• open-source

Website

• Product: https://github.com/lunary-ai/lunary/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion