SQL Injection Vulnerability in Lunary API
CVE-2024-7456

9.8CRITICAL

Key Information:

Vendor

Lunary-ai

Status
Lunary-ai/lunary
Vendor
CVE Published:
1 November 2024

What is CVE-2024-7456?

A SQL injection vulnerability has been identified in the /api/v1/external-users endpoint of Lunary AI's Lunary product, specifically in version v1.4.2. The vulnerability arises from the order by clause in an SQL query that utilizes an unsanitized input through sql.unsafe. This allows attackers to construct a malicious orderByClause without any server-side validation or sanitation, which can lead to execution of arbitrary SQL commands. Successful exploitation of this vulnerability has significant potential consequences, including complete data loss, unauthorized modification, or corruption of sensitive information.

Affected Version(s)

lunary-ai/lunary < 1.4.3

References

https://huntr.com/bounties/bfb3015e-5642-4d94-ab49-e8b49c...
https://github.com/lunary-ai/lunary/commit/6a0bc201181e0f...

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.