Lucene search

@huntr_aiVULNRICHMENT:CVE-2024-1666

HistoryApr 16, 2024 - 12:00 a.m.

CVE-2024-1666 Unauthorized Radar Creation in lunary-ai/lunary

2024-04-1600:00:13

CWE-770

@huntr_ai

github.com

cve-2024-1666

authorization flaw

server-side checks

free account

crafted requests

payment bypass

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:lunary-ai:lunary:*:*:*:*:*:*:*:*"
    ],
    "vendor": "lunary-ai",
    "product": "lunary",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.2.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54

huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-1666