CVE-2024-9096

Executive Summary

CVE-2024-9096 is a missing authorization vulnerability in lunary-ai/lunary version 1.4.28. The /checklists/:id route allows low-privilege users to modify checklists via a PATCH request without proper access control. This enables any project-associated user to alter checklist data, including slugs and fields, leading to tampering with project workflows and business logic integrity. The CVSS score is 7.6 (High), with an EPSS score of 0.0% indicating low exploitation likelihood. No public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary package, which is a Node.js application. The lack of access control in the API route poses a supply chain risk if the package is used as a dependency in other projects. Users should monitor for updates and apply patches once available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.6 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

The threat level is High due to the integrity impact, allowing unauthorized modification of critical project data.

Deep Dive & Mechanics

The vulnerability exists in the /checklists/:id route of the lunary-ai/lunary application (version 1.4.28). The route accepts PATCH requests to update checklist items. However, it lacks middleware or authorization checks to verify that the requesting user has the appropriate role (e.g., project owner or admin). As a result, any user associated with the project can modify checklists, including changing the slug or data fields. This can lead to tampering with essential project workflows, altering business logic, and introducing errors that undermine integrity.

The root cause is the absence of role-based access control (RBAC) enforcement on the PATCH endpoint. The application likely uses a simple user-project association without verifying permissions for modification operations.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.4.28):

// routes/checklists.js
router.patch('/checklists/:id', async (req, res) => {
  const { id } = req.params;
  const updates = req.body;
  // Missing authorization check
  const checklist = await Checklist.findByIdAndUpdate(id, updates, { new: true });
  res.json(checklist);
});

Patched Code (hypothetical):

// routes/checklists.js
const authorize = require('../middleware/authorize');

router.patch('/checklists/:id', authorize(['admin', 'project_owner']), async (req, res) => {
  const { id } = req.params;
  const updates = req.body;
  const checklist = await Checklist.findByIdAndUpdate(id, updates, { new: true });
  res.json(checklist);
});

The patched version includes an authorize middleware that checks the user's role before allowing modifications.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running lunary-ai/lunary version 1.4.28.
2. Obtain a valid low-privilege user session token (e.g., via registration or credential stuffing).
3. Send a PATCH request to /checklists/:id with modified data:

   PATCH /checklists/123 HTTP/1.1
   Host: target.com
   Authorization: Bearer <low_priv_token>
   Content-Type: application/json
   
   {
     "slug": "malicious-slug",
     "data": "tampered content"
   }
   

4. Verify the checklist is updated, confirming unauthorized modification.

Lab Setup:

• Deploy lunary-ai/lunary v1.4.28 using Docker:

  docker run -d -p 3000:3000 lunary-ai/lunary:1.4.28
  

• Create a low-privilege user and obtain a token.
• Use curl or Postman to send the PATCH request.

Blue Team

Detection Steps:

• Monitor API logs for PATCH requests to /checklists/:id from non-admin users.
• Alert on multiple modification attempts within a short timeframe.
• Implement rate limiting on checklist modification endpoints.

Hunting Queries:

• Search for PATCH requests to /checklists/ with unusual payloads (e.g., slug changes).
• Correlate user roles with modification actions.

Indicators of Compromise (IOCs)

• Network: PATCH requests to /checklists/:id with low-privilege tokens.
• Logs: Unauthorized modification events in application logs.
• File: Modified checklist entries in the database with unexpected slugs or data.

Detection Engineering

YARA Rule

rule CVE_2024_9096_Checklist_Modification {
    meta:
        description = "Detects unauthorized PATCH requests to /checklists/:id in lunary-ai/lunary"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9096"
    strings:
        $method = "PATCH"
        $path = "/checklists/"
        $body_slug = "slug"
        $body_data = "data"
    condition:
        $method and $path and ($body_slug or $body_data)
}

Sigma Rule

title: Unauthorized Checklist Modification in lunary-ai/lunary
id: cve-2024-9096
status: experimental
description: Detects PATCH requests to /checklists/:id from low-privilege users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        method: 'PATCH'
        path|startswith: '/checklists/'
    condition: selection
falsepositives:
    - Legitimate admin modifications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9096 - Unauthorized Checklist Modification"; flow:to_server; http.method; content:"PATCH"; http.uri; content:"/checklists/"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Restrict access to the /checklists/:id PATCH endpoint to admin or project owner roles.
• Implement middleware to verify user permissions before processing modifications.
• Monitor logs for suspicious PATCH requests.

Long-term Fix:

• Apply the official patch once released by lunary-ai.
• Conduct a security audit of all API routes for missing authorization checks.
• Implement role-based access control (RBAC) across the application.

Workarounds:

• Use a web application firewall (WAF) to block PATCH requests to /checklists/ from non-admin IPs.
• Temporarily disable the checklist modification feature if not critical.

Valters IT
Securing Digital Frontiers