CVE-2024-9099

In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc	Patch
https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1c93e91	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:1.4.29:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-04-10 15:42

NVD link : CVE-2024-9099

Mitre link : CVE-2024-9099

CVE.ORG link : CVE-2024-9099

JSON object : View

Products Affected

lunary

lunary

CWE

CWE-1230

Exposure of Sensitive Information Through Metadata

NVD-CWE-Other

{"id": "CVE-2024-9099", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2025-03-20T10:15:47.097", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1c93e91", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1230"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend."}, {"lang": "es", "value": "En la versi\u00f3n v1.4.29 de lunary-ai/lunary, el endpoint de la API GET/projects expone las claves de API p\u00fablicas y privadas de todos los proyectos a usuarios con permisos m\u00ednimos, como visualizadores o editores de indicaciones. Esta vulnerabilidad permite a usuarios no autorizados recuperar credenciales confidenciales, que pueden utilizarse para realizar acciones en nombre del proyecto, acceder a datos privados y eliminar recursos. Las claves de API privadas se exponen en las herramientas de desarrollo cuando se llama al endpoint desde el frontend."}], "lastModified": "2025-04-10T15:42:18.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:1.4.29:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDF19791-BA2D-4808-B52C-B30C26EFF556"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}