CVE-2024-8763
📋 TL;DR
A Regular Expression Denial of Service (ReDoS) vulnerability in lunary-ai/lunary allows attackers to cause indefinite server hangs by sending specially crafted input with excessive braces. This affects systems running the vulnerable version of the lunary repository, potentially making web services unresponsive to legitimate requests.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage where the server becomes completely unresponsive, requiring manual restart and causing extended downtime.
Likely Case
Temporary service degradation or denial of service affecting specific endpoints that process the vulnerable template function.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending malicious input to endpoints using the compileTextTemplate function. The vulnerability is documented in public bug bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 7ff89b0304d191534b924cf063f3648206d497fa
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
Restart Required: No
Instructions:
1. Update to the latest lunary-ai/lunary repository version. 2. Ensure you're using commit 7ff89b0304d191534b924cf063f3648206d497fa or later. 3. Verify the compileTextTemplate function has been patched.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject inputs with excessive braces or nested patterns that could trigger ReDoS.
Rate Limiting
allApply rate limiting to endpoints using the compileTextTemplate function to prevent mass exploitation attempts.
🧯 If You Can't Patch
- Implement WAF rules to block requests with patterns containing excessive braces or nested {{}} sequences.
- Monitor server performance metrics and set alerts for abnormal CPU usage or response time spikes on affected endpoints.
🔍 How to Verify
Check if Vulnerable:
Check if your lunary repository version is at commit be54057 or earlier. Review code for the compileTextTemplate function using the vulnerable regex pattern /{{(.*?)}}/g.Check Version:
git log --oneline -1Verify Fix Applied:
Verify the repository uses commit 7ff89b0304d191534b924cf063f3648206d497fa or later. Test with sample inputs containing nested braces to ensure no performance degradation.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for template compilation requests
- High CPU usage spikes correlated with specific request patterns
- Requests with excessive braces in payloads
Network Indicators:
- Repeated requests to template endpoints with similar payload patterns
- Abnormal request sizes containing many brace characters
SIEM Query:
source="web_logs" AND (uri="*template*" OR uri="*compile*") AND (payload="*{{*" OR payload="*}}*") | stats count by src_ip