Insecure Direct Object Reference Vulnerability in Lunary AI Product by Lunary

CVE-2024-11137

What is CVE-2024-11137?

An Insecure Direct Object Reference (IDOR) vulnerability exists in the PATCH /v1/runs/:id/score endpoint of Lunary AI's Lunary, specifically version 1.6.0. This security flaw allows an authenticated attacker to alter score data for any run by simply manipulating the 'id' parameter in the request URL. The application fails to properly verify if the user has the necessary permissions to modify the targeted runId, thus enabling users to modify scores associated with other users' runs by submitting different id values. This issue was addressed and resolved in version 1.6.1.

References