CVE-2024-5133 Account Takeover via Exposed Recovery Token in lunary-ai/lunary
Authenticated users can steal password recovery tokens from API responses to take over other team members' accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5133?
CVE-2024-5133 is a critical vulnerability in Lunary Lunary, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.
Weakness: CWE-200
Which versions are affected by CVE-2024-5133?
It affects 1 product.
Products include Lunary Lunary.
How do I fix CVE-2024-5133?
No fix has been published for CVE-2024-5133 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5133 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5133 exists.
Other vulnerabilities in Lunary Lunary
- CVE-2024-8999 Improper Access Control in lunary-ai/lunary
- CVE-2024-9095 Improper Authorization in lunary-ai/lunary
- CVE-2024-7456 SQL Injection in lunary-ai/lunary
- CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-5386 Account Hijacking via Password Reset Token Leak in lunary-ai/lunary
Sources
Also known as GHSA-p77v-7332-v474.