Is CVE-2024-4146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-4146 being exploited in the wild.

How severe is CVE-2024-4146?

Low severity, with a CVSS score of 3.1, published 8 June 2024.

Which products and versions are affected?

lunary (npm) SEMVER:introduced=0,fixed=1.2.26.

Is there a fix for CVE-2024-4146?

Yes. lunary (npm): upgrade to 1.2.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-4146 attacked?

It is attacked over the network.

Am I affected by CVE-2024-4146?

Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-4146: lunary-ai lunary authorization bypass in project access

CVE-2024-4146 · Severity: low · CVSS 3.1 · Published 2024-06-08

Lunary is an open-source platform for managing and monitoring AI/LLM applications. A flaw in its project access controls allows any authenticated user within an organization to access and modify projects they should not have permission to view, potentially exposing sensitive AI models, configurations, and data. An attacker with basic organizational membership can read, create, update, or delete resources in any project.

Technologies: lunary (npm). Vendors: npm.

Quick answers

Is CVE-2024-4146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-4146 being exploited in the wild.
How severe is CVE-2024-4146?: Low severity, with a CVSS score of 3.1, published 8 June 2024.
Which products and versions are affected?: lunary (npm) SEMVER:introduced=0,fixed=1.2.26.
Is there a fix for CVE-2024-4146?: Yes. lunary (npm): upgrade to 1.2.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-4146 attacked?: It is attacked over the network.
Am I affected by CVE-2024-4146?: Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lunary (npm): upgrade to 1.2.26 or later
```
npm install lunary@1.2.26
```

Technical details

The vulnerability is an authorization bypass (CWE-863) in the checkProjectAccess middleware method. The flaw resides in inadequate permission checks for project access: the code verifies only that a user belongs to the organization owning the project, but fails to validate explicit project-level access rights via the account_project table. This allows any authenticated organization member to access and fully manipulate all projects. The vulnerability affects versions before 1.2.26 and was patched in that version. Attack requires network access and valid organizational credentials, but no special privileges or user interaction.

Affected products

lunary-ai lunary before 1.2.26

Identifiers

CVE-2024-4146
GHSA-w5xm-mx47-v7c8

Timeline

2024-06-08: disclosed
2024-06-10: patched: Version 1.2.26 fixes the vulnerability

References

https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.