CVE-2024-3379
📋 TL;DR
An incorrect authorization vulnerability in lunary-ai/lunary allows users with 'Member' role to regenerate private keys for projects they shouldn't have access to. This affects versions 1.2.2 through 1.2.6, potentially compromising project security and data integrity.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users regenerate project private keys, gaining full access to sensitive project data, potentially leading to data theft, manipulation, or complete project compromise.
Likely Case
Internal users with Member roles accidentally or intentionally regenerate keys for projects they shouldn't access, causing service disruption and requiring key rotation.
If Mitigated
With proper role-based access controls, only authorized administrators can regenerate keys, maintaining project isolation and security.
🎯 Exploit Status
Exploitation requires authenticated Member role access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.7
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Update lunary to version 1.2.7 or later using your package manager. 3. Restart the lunary service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Temporary Role Restriction
allTemporarily restrict Member role permissions or elevate authorization checks for key regeneration endpoints.
Modify authorization middleware to enforce project membership checks for /api/projects/*/regenerate-key endpoints
🧯 If You Can't Patch
- Immediately audit all project key regeneration events in logs for unauthorized attempts.
- Temporarily disable key regeneration functionality for non-admin users until patching is possible.
🔍 How to Verify
Check if Vulnerable:
Check your lunary version: if it's between 1.2.2 and 1.2.6 inclusive, you are vulnerable.Check Version:
Check package.json or run: npm list lunary-ai/lunaryVerify Fix Applied:
After updating to 1.2.7+, test that Member role users cannot regenerate keys for projects they aren't assigned to.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /api/projects/*/regenerate-key endpoints
- Key regeneration events from non-admin users for projects they aren't members of
Network Indicators:
- HTTP 200 responses to key regeneration requests from unauthorized IPs/users
SIEM Query:
source="lunary" AND (uri_path="/api/projects/*/regenerate-key" AND user_role="Member")