CVE-2024-4148

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lunary-ai/lunary/commit/1e8a3d941ba5cfef2c478dd5bac4e4a4b4d67830
https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31	Exploit Third Party Advisory
https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:1.2.10:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-01 16:15

Updated : 2025-01-30 13:15

NVD link : CVE-2024-4148

Mitre link : CVE-2024-4148

CVE.ORG link : CVE-2024-4148

JSON object : View

Products Affected

lunary

lunary

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2024-4148", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-01T16:15:07.563", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/1e8a3d941ba5cfef2c478dd5bac4e4a4b4d67830", "source": "[email protected]"}, {"url": "https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes."}, {"lang": "es", "value": "Existe una vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) en la aplicaci\u00f3n lunary-ai/lunary, versi\u00f3n 1.2.10. Un atacante puede aprovechar esta vulnerabilidad manipulando maliciosamente expresiones regulares, lo que puede afectar significativamente el tiempo de respuesta de la aplicaci\u00f3n y potencialmente hacerla completamente no funcional. Espec\u00edficamente, la vulnerabilidad puede desencadenarse enviando una solicitud especialmente manipulada a la aplicaci\u00f3n, lo que lleva a una denegaci\u00f3n de servicio donde la aplicaci\u00f3n falla."}], "lastModified": "2025-01-30T13:15:10.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:1.2.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B63FE78-9598-47D1-836B-1FD93665AA89"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}