CVE-2024-8998

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lunary-ai/lunary/commit/f2bfa036caf2c48686474f4560a9c5abcf5f43b7	Patch
https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e	Exploit
https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-04-04 09:15

NVD link : CVE-2024-8998

Mitre link : CVE-2024-8998

CVE.ORG link : CVE-2024-8998

JSON object : View

Products Affected

lunary

lunary

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2024-8998", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:45.707", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/f2bfa036caf2c48686474f4560a9c5abcf5f43b7", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26."}, {"lang": "es", "value": "Existe una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en la versi\u00f3n git f07a845 de lunary-ai/lunary. El servidor utiliza la expresi\u00f3n regular /{.*?}/ para coincidir con cadenas controladas por el usuario. En el motor de expresiones regulares predeterminado de JavaScript, esta expresi\u00f3n regular puede tardar un tiempo polin\u00f3mico en coincidir con ciertas entradas de usuario manipuladas. Como resultado, un atacante puede provocar que el servidor se bloquee durante un tiempo arbitrario enviando un payload especialmente manipulada. Este problema se solucion\u00f3 en la versi\u00f3n 1.4.26."}], "lastModified": "2025-04-04T09:15:16.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F305269-C264-41FA-9611-4F271C6CF9EE", "versionEndExcluding": "1.4.26"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}