CVE-2024-1739
📋 TL;DR
This vulnerability allows attackers to create multiple accounts with the same email address by varying character case (e.g., User@example.com vs user@example.com). This affects all users of lunary-ai/lunary who rely on email-based authentication and account uniqueness.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Attackers impersonate legitimate users, bypass account recovery mechanisms, create confusion in multi-user environments, and potentially gain unauthorized access to sensitive data or functionality.
Likely Case
User impersonation, account confusion, and potential privilege escalation if different accounts have different permissions.
If Mitigated
Minor inconvenience during signup with proper validation, but no security impact.
🎯 Exploit Status
Simple to exploit via signup form manipulation; proof-of-concept demonstrated in bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 7351157a21e5acd0162b4528bcae9d65b1c95695
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695
Restart Required: No
Instructions:
1. Update to latest lunary-ai/lunary version. 2. Apply commit 7351157a21e5acd0162b4528bcae9d65b1c95695. 3. Ensure email validation treats addresses as case-insensitive.
🔧 Temporary Workarounds
Email normalization middleware
allAdd middleware to normalize email addresses to lowercase before processing.
Implement email.toLowerCase() or equivalent in signup/login handlers
🧯 If You Can't Patch
- Implement server-side email normalization to lowercase all email addresses during authentication.
- Add database constraints to prevent duplicate emails regardless of case.
🔍 How to Verify
Check if Vulnerable:
Attempt to create two accounts with same email but different case (e.g., test@example.com and Test@example.com).Check Version:
Check git commit hash or version against patched commit 7351157a21e5acd0162b4528bcae9d65b1c95695.Verify Fix Applied:
Verify that duplicate email creation fails regardless of case variations.📡 Detection & Monitoring
Log Indicators:
- Multiple account creations with similar email patterns (case variations)
- Failed login attempts with case-varied emails
Network Indicators:
- Unusual signup patterns from single IP
SIEM Query:
source="auth_logs" AND (event="signup" OR event="login") | stats count by lower(email)