CVE-2024-10762

Executive Summary

CVE-2024-10762 is a critical authorization bypass vulnerability in lunary-ai/lunary, an open-source AI observability and evaluation platform. The vulnerability resides in the /v1/evaluators/ endpoint, which allows any authenticated user, regardless of their role or privilege level, to delete evaluators from a project by sending a DELETE request. The endpoint lacks proper access control middleware to verify that the requesting user has the appropriate permissions (e.g., admin or project owner) to perform such destructive actions. This flaw enables low-privilege users to permanently delete evaluator data, leading to irreversible data loss and potential disruption of AI model evaluation workflows. The vulnerability has a CVSS score of 8.1 (High) and affects all versions before 1.5.9. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward and requires only network access and low-privilege authentication.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary open-source project, which is distributed as a Python package (via PyPI) and also as a Docker image. Organizations using lunary for AI observability should immediately verify their deployment version and upgrade to 1.5.9 or later. Since the package is open-source, supply chain risks include potential malicious forks or compromised dependencies. Ensure that the package is sourced from the official GitHub repository (github.com/lunary-ai/lunary) and that integrity checks (e.g., checksum verification) are performed during deployment.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – An attacker needs only low-privilege user credentials (e.g., a regular project member).
• User Interaction (UI): None – The attack does not require any action from a victim or other user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): High – An attacker can delete evaluator data, causing permanent loss.
• Availability (A): High – Deleting evaluators can disrupt AI model evaluation operations, leading to service degradation.

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and results in irreversible data loss. Although no public exploit exists, the attack vector is trivial to implement.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) flaw. The /v1/evaluators/ endpoint in lunary is designed to manage evaluators (e.g., metrics, scoring functions) for AI projects. When a DELETE request is sent to this endpoint, the server should verify that the authenticated user has the necessary role (e.g., admin, project owner) to delete evaluators. However, the code lacks any such check, allowing any authenticated user to delete evaluators belonging to any project they have access to.

Attack Flow:

1. An attacker obtains low-privilege credentials (e.g., a regular user account) for a lunary instance.
2. The attacker sends a DELETE request to /v1/evaluators/ with the target evaluator ID in the request body or URL parameters.
3. The server processes the request without verifying the user's role, deleting the evaluator from the database.
4. The evaluator data is permanently lost, potentially breaking AI evaluation pipelines that depend on that evaluator.

Root Cause: The route handler for the DELETE method on /v1/evaluators/ does not include middleware or logic to check user permissions. This is a common oversight in REST API development where authorization checks are not consistently applied to all HTTP methods.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.5.9):

# routes/evaluators.py (simplified)
@router.delete("/v1/evaluators/")
async def delete_evaluator(evaluator_id: str, user: User = Depends(get_current_user)):
    # No authorization check - any authenticated user can delete
    await database.delete_evaluator(evaluator_id)
    return {"status": "deleted"}

Patched Code (version 1.5.9):

# routes/evaluators.py (simplified)
@router.delete("/v1/evaluators/")
async def delete_evaluator(evaluator_id: str, user: User = Depends(get_current_user)):
    # Authorization check added
    if not user.has_permission("delete_evaluator"):
        raise HTTPException(status_code=403, detail="Insufficient permissions")
    await database.delete_evaluator(evaluator_id)
    return {"status": "deleted"}

The patch introduces a permission check (user.has_permission("delete_evaluator")) that ensures only users with the appropriate role (e.g., admin) can delete evaluators. The exact implementation may vary, but the principle is to enforce role-based access control (RBAC) on the DELETE endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a lunary instance (version < 1.5.9)
• Low-privilege user credentials (e.g., username: attacker, password: password123)

Exploitation Steps:

1. Authenticate and obtain a session token or API key.
2. Identify a target evaluator ID (e.g., by listing evaluators via GET /v1/evaluators/).
3. Send a DELETE request to delete the evaluator.

Example using cURL:

# Authenticate and get token
curl -X POST https://target-lunary.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "attacker", "password": "password123"}'

# Use the token to delete an evaluator
curl -X DELETE "https://target-lunary.com/v1/evaluators/?evaluator_id=12345" \
  -H "Authorization: Bearer <token>"

Expected Outcome: The evaluator with ID 12345 is permanently deleted. The server returns a 200 OK response.

Blue Team (Detection & Defense)

Detection:

• Monitor logs for DELETE requests to /v1/evaluators/ from non-admin users.
• Alert on multiple DELETE requests to evaluators within a short time window.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to lunary version 1.5.9 or later.
• If upgrading is not possible, implement a reverse proxy (e.g., Nginx) to block DELETE requests to /v1/evaluators/ from non-admin IPs.
• Enforce strict RBAC and audit user permissions regularly.
• Enable logging and monitoring for all API endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP DELETE requests to /v1/evaluators/ with a valid evaluator_id parameter.
  • Unusual patterns of evaluator deletions (e.g., bulk deletions).
• Log IOCs:
  • Log entries showing DELETE /v1/evaluators/ from users with low-privilege roles.
  • Error logs indicating missing evaluator references after deletion.
• System IOCs:
  • Missing evaluator data in the database.
  • Broken AI evaluation pipelines or dashboards.

Detection Engineering

YARA Rule

rule Detect_Lunary_Evaluator_Deletion {
    meta:
        description = "Detects DELETE requests to /v1/evaluators/ endpoint in lunary logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10762"
    strings:
        $method = "DELETE"
        $path = "/v1/evaluators/"
        $param = "evaluator_id"
    condition:
        all of them
}

Sigma Rule

title: Lunary Evaluator Deletion by Low-Privilege User
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized deletion of evaluators in lunary-ai/lunary
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: lunary
detection:
    selection:
        http.method: DELETE
        http.url.path: /v1/evaluators/
        http.url.query|contains: evaluator_id
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10762 - Lunary Evaluator Deletion Attempt"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/v1/evaluators/"; http.uri; content:"evaluator_id"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update lunary to version 1.5.9 or later. This is the only complete fix.
2. Workaround: If upgrading is not possible, implement a reverse proxy rule to block DELETE requests to /v1/evaluators/ from non-admin users. Example Nginx rule:

   location /v1/evaluators/ {
       limit_except GET POST {
           deny all;
       }
   }
   

3. Audit: Review user permissions and remove unnecessary low-privilege accounts.

Long-Term Measures:

• Implement RBAC for all API endpoints.
• Conduct regular security audits and penetration testing.
• Enable detailed logging and monitoring for all destructive operations.
• Follow the principle of least privilege (PoLP) for all users.

Patch Details: Upgrade to lunary version 1.5.9, which includes the authorization check for the DELETE endpoint. The patch is available in the official GitHub repository: https://github.com/lunary-ai/lunary/releases/tag/v1.5.9

Valters IT