Lucene search

@huntr_aiCVE-2024-5133

HistoryJun 06, 2024 - 7:16 p.m.

CVE-2024-5133

2024-06-0619:16:05

CWE-200

@huntr_ai

web.nvd.nist.gov

lunary ai version 1.2.4

account takeover

recovery tokens

api responses

password reset

authenticated user

user's password

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the GET /v1/users/me/org endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user’s password without consent, effectively taking over the account. The issue lies in the inclusion of the recovery_token attribute in the users object returned by the API.

Affected configurations

Vulnrichment

Node

lunary-ailunaryMatch1.2.4

VendorProductVersionCPE
lunary-ailunary1.2.4cpe:2.3:a:lunary-ai:lunary:1.2.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lunary-ai	lunary	1.2.4	cpe:2.3:a:lunary-ai:lunary:1.2.4:::::::*

CNA Affected

[
  {
    "vendor": "lunary-ai",
    "product": "lunary-ai/lunary",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

References

huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-5133