CVE-2024-7476

Executive Summary

CVE-2024-7476 is a broken access control vulnerability in lunary-ai/lunary versions 1.2.7 through 1.4.2. An authenticated attacker can exploit this flaw to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. The vulnerability arises from insufficient authorization checks, allowing a low-privileged user to tamper with templates belonging to other users. The issue is resolved in version 1.4.3.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary Python package. Users should verify their installed version and update to the patched release. No known malicious packages or typosquatting have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authentication and the limited impact on integrity. However, the ability to modify any user's templates could lead to data corruption or injection of malicious content.

Deep Dive & Mechanics

The vulnerability exists in the template version management endpoint. The application fails to verify that the authenticated user has ownership or appropriate permissions over the template being modified. By sending a POST request to /v1/templates/{id}/versions with a valid template ID, an attacker can create new versions of templates they do not own.

The core issue is a missing or insufficient authorization check in the backend logic. The endpoint likely retrieves the template by ID but does not compare the template's owner with the authenticated user's identity before allowing modifications.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/v1/templates/<template_id>/versions', methods=['POST'])
@login_required
def create_template_version(template_id):
    template = Template.query.get(template_id)
    if not template:
        return jsonify({'error': 'Template not found'}), 404
    # Missing ownership check
    new_version = TemplateVersion(template_id=template.id, data=request.json)
    db.session.add(new_version)
    db.session.commit()
    return jsonify({'version_id': new_version.id}), 201

Patched Code (Conceptual):

@app.route('/v1/templates/<template_id>/versions', methods=['POST'])
@login_required
def create_template_version(template_id):
    template = Template.query.get(template_id)
    if not template:
        return jsonify({'error': 'Template not found'}), 404
    # Added ownership check
    if template.owner_id != current_user.id:
        return jsonify({'error': 'Forbidden'}), 403
    new_version = TemplateVersion(template_id=template.id, data=request.json)
    db.session.add(new_version)
    db.session.commit()
    return jsonify({'version_id': new_version.id}), 201

Exploitation & Lab Setup

Red Team

1. Prerequisites: Valid authentication credentials for a lunary instance.
2. Identify Target: Obtain a template ID belonging to another user (e.g., via enumeration or observation).
3. Craft Request:

   curl -X POST https://target.com/v1/templates/{victim_template_id}/versions \
     -H "Authorization: Bearer <your_token>" \
     -H "Content-Type: application/json" \
     -d '{"content": "malicious template data"}'
   

4. Verify: Check that the new version appears under the victim's template.

Blue Team

1. Monitor Logs: Look for POST requests to /v1/templates/*/versions from users who do not own the referenced template.
2. Audit Permissions: Review access control lists and ensure template ownership is enforced.
3. Honeypot: Deploy a fake template with a known ID and monitor for unauthorized version creation attempts.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /v1/templates/{id}/versions where {id} is not owned by the requester.
• Logs: Server logs showing 403 Forbidden after patching, or successful creation of template versions by unexpected users.
• File System: Unexpected template version entries in the database for templates not owned by the creating user.

Detection Engineering

YARA Rule

rule CVE_2024_7476_lunary_broken_access {
    meta:
        description = "Detects exploitation attempts for CVE-2024-7476"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7476"
    strings:
        $endpoint = "/v1/templates/"
        $versions = "/versions"
        $method = "POST"
    condition:
        $endpoint and $versions and $method
}

Sigma Rule

title: CVE-2024-7476 - Broken Access Control in lunary-ai/lunary
id: 8a3f7c2e-5d1b-4a9e-8c6f-2b3d1e4f5a6c
status: experimental
description: Detects unauthorized POST requests to template version endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/v1/templates/'
        cs-uri-stem|endswith: '/versions'
    condition: selection
falsepositives:
    - Legitimate template version creation by template owners
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7476 - Broken Access Control in lunary-ai/lunary"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/templates/"; distance:0; content:"/versions"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to lunary version 1.4.3 or later.
2. Workaround: If immediate upgrade is not possible, implement a reverse proxy rule to restrict access to the /v1/templates/*/versions endpoint based on user roles.
3. Long-term: Conduct a thorough access control audit across all API endpoints. Implement ownership checks using middleware or decorators.
4. Monitoring: Enable detailed logging for all template modification requests and alert on anomalies.

Report generated by Valters IT DevSecOps & CTI Division