CVE-2024-1739: lunary — Exploit & Fix

Description

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for '[email protected]' and '[email protected]' can both be created, leading to potential impersonation and confusion among users.

Is your site exposed to CVE-2024-1739?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-821 CWE-821

Affected Products

Vendor	Product	Versions
lunary	lunary	< 1.0.2

References

Advisories & Patches

https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695 https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695

Exploits

https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300 https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300

Frequently Asked Questions

What is CVE-2024-1739? +

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for '[email protected]' and '[email protected]' can both be created, leading to potential impersonation and confusion among users. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2024-1739? +

CVE-2024-1739 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-1739? +

CVE-2024-1739 affects products from lunary, specifically: lunary. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1739? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-1902 7.5

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. …

CVE-2024-6657 6.5

A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices …

CVE-2024-4278 5.5

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from …

CVE-2024-5755 5.3

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. …

CVE-2024-58131 4.0

FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a …

CVE-2024-58132 4.0

In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform …

CVE-2024-1739