CVE-2024-7456
📋 TL;DR
This SQL injection vulnerability in lunary-ai/lunary v1.4.2 allows attackers to execute arbitrary SQL commands through the `/api/v1/external-users` endpoint. The vulnerability affects all systems running the vulnerable version, potentially leading to complete database compromise. Organizations using lunary-ai/lunary v1.4.2 or earlier are at risk.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, deletion, and potential remote code execution on the database server.
Likely Case
Data exfiltration, privilege escalation, and database corruption through SQL injection payloads.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
SQL injection via orderBy parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e
Restart Required: Yes
Instructions:
1. Update to latest lunary-ai/lunary version 2. Restart the application 3. Verify the fix by checking the commit hash includes 6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict orderBy parameter to allowed values only
Implement input validation middleware before SQL query execution
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns
Configure WAF to detect and block SQL injection patterns in orderBy parameter
🧯 If You Can't Patch
- Block external access to /api/v1/external-users endpoint using firewall rules
- Implement rate limiting and input validation at the application layer
🔍 How to Verify
Check if Vulnerable:
Test the /api/v1/external-users endpoint with SQL injection payloads in the orderBy parameterCheck Version:
git log --oneline -1Verify Fix Applied:
Verify the commit hash includes 6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Unexpected database errors
Network Indicators:
- SQL keywords in HTTP parameters
- Unusual traffic patterns to /api/v1/external-users
SIEM Query:
source="web_logs" AND uri="/api/v1/external-users" AND (param="orderBy" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|create|alter)")