CVE-2024-9099

Executive Summary

CVE-2024-9099 is a critical information disclosure vulnerability in lunary-ai/lunary version v1.4.29. The GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend. The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched.

Supply Chain & Package Security

This vulnerability affects the lunary-ai/lunary project, which is a Python-based AI monitoring and observability platform. The exposure of API keys through the API endpoint poses a significant supply chain risk, as compromised keys could be used to access and manipulate AI model data, training datasets, and other sensitive resources managed by the platform.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs only minimal privileges (Viewer or Prompt Editor role).
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Private API keys are exposed, leading to complete loss of confidentiality.
• Integrity (I): High (H) - Exposed keys can be used to modify or delete resources.
• Availability (A): High (H) - Exposed keys can be used to delete resources, impacting availability.

Threat Level: High. The vulnerability allows low-privileged users to escalate their access and compromise the entire project.

Deep Dive & Mechanics

The vulnerability resides in the GET /projects API endpoint. When a user with minimal permissions (Viewer or Prompt Editor) makes a request to this endpoint, the server returns a list of all projects along with their associated API keys, including both public and private keys. The private keys are intended to be secret and should only be accessible to project administrators or owners.

The issue is exacerbated by the fact that the frontend application calls this endpoint and exposes the response in developer tools, making it trivial for any user to inspect the network traffic and extract the keys. The lack of proper authorization checks on the server side allows users with low privileges to access sensitive data that should be restricted.

The vulnerability can be exploited by:

1. Logging in as a user with Viewer or Prompt Editor role.
2. Opening the browser's developer tools (Network tab).
3. Making a request to GET /projects.
4. Inspecting the response to extract the private API keys for all projects.

Vulnerable vs. Patched Code

Vulnerable Code (v1.4.29): The vulnerable endpoint likely lacks proper authorization checks. A simplified example of the vulnerable code might look like:

@app.route('/projects', methods=['GET'])
def get_projects():
    # No authorization check for user role
    projects = Project.query.all()
    return jsonify([project.to_dict() for project in projects])

Patched Code (Hypothetical): A patched version would include authorization checks to ensure only users with appropriate roles (e.g., admin or owner) can access the API keys. Additionally, the endpoint should filter out sensitive fields like private API keys for unauthorized users.

@app.route('/projects', methods=['GET'])
def get_projects():
    user = get_current_user()
    if user.role not in ['admin', 'owner']:
        abort(403, description="Insufficient permissions")
    projects = Project.query.all()
    return jsonify([project.to_dict() for project in projects])

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable instance of lunary-ai/lunary v1.4.29.
2. Create a user with Viewer or Prompt Editor role.
3. Log in as that user.

Exploitation Steps:

1. Open browser developer tools (F12) and go to the Network tab.
2. Navigate to the projects page or directly call the API endpoint:

   GET /projects HTTP/1.1
   Host: target-lunary-instance.com
   Authorization: Bearer <viewer_token>
   

3. Inspect the response in the Network tab. The response will contain all projects with their public and private API keys.
4. Extract the private API keys and use them to perform actions on behalf of the project, such as:
   • Accessing private data
   • Modifying resources
   • Deleting projects

Example cURL command:

curl -X GET https://target-lunary-instance.com/projects \
  -H "Authorization: Bearer <viewer_token>"

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual API calls to /projects from users with low privileges.
• Alert on any use of private API keys that were exposed through this vulnerability.
• Monitor for unauthorized access to project resources.

Defense:

• Immediately restrict access to the /projects endpoint to only admin users.
• Rotate all exposed API keys.
• Implement proper authorization checks on all API endpoints.
• Use API gateways to enforce role-based access control.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API calls to /projects from low-privileged users.
  • Use of private API keys in requests from unexpected IP addresses.
• File IOCs:
  • Log entries showing access to /projects by users with Viewer or Prompt Editor roles.
• Behavioral IOCs:
  • Sudden changes to project configurations or resources by unauthorized users.
  • Deletion of projects or data by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_9099_Lunary_API_Key_Exposure {
    meta:
        description = "Detects exposure of private API keys in lunary-ai/lunary /projects endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9099"
        severity = "high"
    strings:
        $private_key = /"privateApiKey":\s*"[A-Za-z0-9_-]{20,}"/ nocase
        $project_endpoint = "/projects"
    condition:
        $private_key and $project_endpoint
}

Sigma Rule

title: CVE-2024-9099 - Lunary API Key Exposure via /projects Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to the /projects endpoint by low-privileged users, indicating potential exploitation of CVE-2024-9099.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9099
logsource:
    category: web
    product: lunary
detection:
    selection:
        http.method: GET
        http.url: "/projects"
        http.user_agent: "*"
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9099 - Lunary API Key Exposure via /projects Endpoint";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/projects"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2024-9099;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the /projects endpoint to only admin users.
2. Rotate all exposed API keys immediately.
3. Review user roles and permissions to ensure least privilege.

Long-term Fixes:

1. Implement proper authorization checks on all API endpoints.
2. Conduct a security audit of the entire application.
3. Apply the official patch once it becomes available.
4. Implement API key rotation policies and monitoring.

Workarounds:

• Use a reverse proxy or API gateway to block access to /projects for non-admin users.
• Implement network segmentation to limit exposure.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert