CVE-2024-3761
📋 TL;DR
This vulnerability allows any user, including those without authentication, to delete datasets in lunary-ai/lunary by sending a DELETE request to the vulnerable endpoint. It affects all users of version 1.2.2 who have the dataset deletion functionality exposed.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of all datasets, service disruption, and potential business impact from data destruction.
Likely Case
Unauthorized deletion of critical datasets leading to data loss and operational disruption.
If Mitigated
No impact if proper authentication and authorization controls are implemented.
🎯 Exploit Status
Exploitation requires only a simple HTTP DELETE request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.8
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
Restart Required: Yes
Instructions:
1. Update lunary-ai/lunary to version 1.2.8 or later. 2. Restart the application. 3. Verify the fix by testing dataset deletion with proper authentication.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the DELETE endpoint using network controls or web application firewall rules.
Authentication Middleware
allImplement authentication checks before processing DELETE requests to the dataset endpoint.
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the vulnerable endpoint.
- Deploy a web application firewall with rules to block unauthorized DELETE requests to the dataset endpoint.
🔍 How to Verify
Check if Vulnerable:
Send a DELETE request to /api/v1/datasets/{dataset_id} without authentication. If it succeeds, the system is vulnerable.Check Version:
Check package.json or application version endpoint for lunary version.Verify Fix Applied:
Attempt the same DELETE request without authentication. It should return a 401 or 403 error.📡 Detection & Monitoring
Log Indicators:
- Unauthorized DELETE requests to /api/v1/datasets/*
- Dataset deletion events without associated user authentication logs
Network Indicators:
- HTTP DELETE requests to dataset endpoints from unauthenticated sources
SIEM Query:
source=web_logs method=DELETE uri_path="/api/v1/datasets/*" AND NOT user_id=*