CVE-2024-9098

Executive Summary

CVE-2024-9098 is a privilege escalation vulnerability in lunary-ai/lunary, an open-source AI monitoring and analytics platform. The flaw allows authenticated users with the Admin role to invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This violates the intended access control model, where billing permissions should be restricted to specific roles. The vulnerability exists in versions before 1.4.30 and has a CVSS score of 7.3 (High). No public exploit code or proof-of-concept is currently available, but the risk is significant due to the potential for financial resource compromise.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary open-source project, which is distributed as a Docker image and via npm. Organizations using this package should verify their deployment version and apply the patch immediately. The lack of a published advisory on GitHub or OSV increases the risk of unpatched instances in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the attack surface, but once an admin account is compromised, the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the user creation endpoint (POST /api/users or similar). The endpoint does not validate whether the requesting admin has the right to assign billing roles to new users. In a properly configured system, only users with specific billing permissions should be able to invite others with billing access. However, the code allows any admin to set the role field to a billing-related role (e.g., billing_admin, billing_viewer).

The root cause is a missing authorization check on the role assignment during user creation. The endpoint likely checks if the requester is an admin but fails to verify if the admin is allowed to grant billing permissions.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.4.30):

// POST /api/users
async function createUser(req, res) {
  const { email, role } = req.body;
  // Only checks if requester is admin
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  // No check on whether admin can assign billing roles
  const newUser = await db.users.create({ email, role });
  res.json(newUser);
}

Patched Code (version 1.4.30):

// POST /api/users
async function createUser(req, res) {
  const { email, role } = req.body;
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  // New check: only users with billing permission can assign billing roles
  if (isBillingRole(role) && !req.user.permissions.includes('billing:assign')) {
    return res.status(403).json({ error: 'Insufficient permissions to assign billing role' });
  }
  const newUser = await db.users.create({ email, role });
  res.json(newUser);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid admin credentials for a lunary instance running version < 1.4.30.
• Network access to the API endpoint.

Exploitation Steps:

1. Authenticate as an admin user and obtain a session token.
2. Send a POST request to the user creation endpoint with a billing role:

   curl -X POST https://target-lunary-instance/api/users \
     -H "Authorization: Bearer <admin_token>" \
     -H "Content-Type: application/json" \
     -d '{"email": "attacker@example.com", "role": "billing_admin"}'
   

3. The new user with billing permissions is created without additional authorization.
4. Log in as the new user and access billing resources (e.g., payment methods, invoices, subscription details).

Expected Outcome: Unauthorized access to billing data and potential financial manipulation.

Blue Team

Detection:

• Monitor API logs for unusual user creation events, especially those assigning billing roles.
• Alert on any user creation where the role field contains "billing" and the requester is not a designated billing admin.
• Review user role assignments for unexpected billing permissions.

Hunting:

• Query database for users with billing roles created by non-billing admins.
• Check audit logs for POST /api/users requests with role containing "billing".

Indicators of Compromise (IOCs)

• Network: POST requests to /api/users with JSON body containing "role": "billing_admin" or "role": "billing_viewer".
• Logs: User creation events where created_by field is an admin without billing permissions.
• Database: Users with role set to billing_admin or billing_viewer who were created by an admin without billing permissions.

Detection Engineering

YARA Rule

rule Detect_Lunary_Privilege_Escalation {
  meta:
    description = "Detects attempts to exploit CVE-2024-9098 by creating users with billing roles"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "CVE-2024-9098"
  strings:
    $role_billing = /"role"\s*:\s*"billing_[a-z]+"/ nocase
    $endpoint = "/api/users"
  condition:
    $endpoint and $role_billing
}

Sigma Rule

title: Lunary Privilege Escalation via User Creation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of users with billing roles by non-billing admins
author: Valters IT
date: 2024-10-27
logsource:
  category: application
  product: lunary
detection:
  selection:
    endpoint: "/api/users"
    method: "POST"
    body|contains: "billing_"
  condition: selection
falsepositives:
  - Legitimate billing admin creating users
level: high

Suricata Rule

alert http any any -> any any (
  msg:"CVE-2024-9098 - Lunary Privilege Escalation via User Creation";
  flow:to_server;
  content:"POST"; http_method;
  content:"/api/users"; http_uri;
  content:"billing_"; http_client_body;
  classtype:attempted-admin;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade lunary-ai/lunary to version 1.4.30 or later.
2. If immediate upgrade is not possible, implement a WAF rule to block POST requests to /api/users containing "role": "billing_".
3. Review all existing user accounts for unauthorized billing permissions and revoke them.

Long-term Measures:

• Implement role-based access control (RBAC) with granular permissions for billing operations.
• Add audit logging for all user creation and role assignment events.
• Conduct regular security reviews of API endpoints for authorization flaws.

Workaround:

• Manually patch the vulnerable endpoint by adding a permission check as shown in the patched code section.

Valters IT