CVE-2024-1740 Incorrect Authorization in lunary-ai/lunary

Critical 9.1 Published 10 Apr 2024 Updated 1 Aug 2024

Removed users retain access to logs and project details via stale tokens, allowing unauthorized data access and modification in Lunary AI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-1740?

CVE-2024-1740 is a critical missing authorization vulnerability in Lunary Lunary, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.

Weakness: CWE-863

Which versions are affected by CVE-2024-1740?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-1740?

No fix has been published for CVE-2024-1740 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-1740 being exploited?

There is no known exploitation of CVE-2024-1740 in the wild and no public exploit code.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-crgc-qfch-jgr7.