CVE-2024-7474
📋 TL;DR
This IDOR vulnerability in lunary-ai/lunary version 1.3.2 allows authenticated users to view or delete external user accounts by manipulating the 'id' parameter in API requests. The application fails to verify user authorization before processing these requests, potentially exposing sensitive user data. All deployments running the vulnerable version are affected.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Mass exfiltration or deletion of all external user data, leading to complete data loss and privacy violations.
Likely Case
Unauthorized access to sensitive user information and potential account deletion for targeted users.
If Mitigated
Limited impact with proper access controls and monitoring in place.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial via parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 8f563c77d8614a72980113f530c7a9ec15a5f8d5
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
Restart Required: Yes
Instructions:
1. Update to latest lunary-ai/lunary version. 2. Apply commit 8f563c77d8614a72980113f530c7a9ec15a5f8d5. 3. Restart the application.
🔧 Temporary Workarounds
Implement API Authorization Middleware
allAdd server-side authorization checks for all user-related endpoints
Rate Limit User ID Endpoints
allImplement rate limiting on vulnerable endpoints to detect brute force attempts
🧯 If You Can't Patch
- Implement WAF rules to block suspicious ID parameter patterns
- Enable detailed logging for all user data access attempts
🔍 How to Verify
Check if Vulnerable:
Test if authenticated user can access external user data by modifying 'id' parameter in API requestsCheck Version:
Check package.json or application version endpointVerify Fix Applied:
Verify that authorization checks are properly implemented and prevent unauthorized access📡 Detection & Monitoring
Log Indicators:
- Unusual pattern of user ID access attempts
- Failed authorization checks for user endpoints
Network Indicators:
- Multiple sequential requests to user endpoints with varying ID parameters
SIEM Query:
source="application_logs" AND (message="*user*id*" OR message="*authorization*failed*")