CVE-2024-3760 Email Bombing Vulnerability in lunary-ai/lunary

High 7.5 Published 14 Nov 2024 Updated 18 Nov 2024

Attackers can flood user mailboxes and overwhelm mail servers by exploiting missing rate limits on the password reset page, causing service disruption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3760?

CVE-2024-3760 is a high-severity denial of service vulnerability in Lunary Lunary, published on 14 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only overwhelms the victim's mailbox, making it difficult to manage and locate legitimate emails, but also significantly impacts mail servers by consuming their resources. The increased load can cause performance degradation and, in severe cases, make the mail servers unresponsive or unavailable, disrupting email services for the entire organization.

Weakness: CWE-770

Which versions are affected by CVE-2024-3760?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-3760?

No fix has been published for CVE-2024-3760 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-3760 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3760 exists.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-qqwx-8prm-3682.