Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 10 June 2024.

Which products and versions are affected?

lunary (npm) SEMVER:introduced=0,fixed=1.4.9.

Is there a fix for This vulnerability?

Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Lunary-ai Lunary access control bypass in prompt variation management

Severity: low · CVSS 3.1 · Published 2024-06-10

Lunary, an observability platform for AI applications, contains a security flaw in how it manages AI prompt variations. This vulnerability allows a user from one organization to view, modify, or delete prompt data belonging to a completely different organization. This could lead to the theft of proprietary AI prompts or the disruption of AI experiments and production workflows.

Technologies: lunary (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 10 June 2024.
Which products and versions are affected?: lunary (npm) SEMVER:introduced=0,fixed=1.4.9.
Is there a fix for This vulnerability?: Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lunary (npm): upgrade to 1.4.9 or later
```
npm install lunary@1.4.9
```

Technical details

An Insecure Direct Object Reference (IDOR) or insufficient granularity of access control exists in Lunary version 1.2.13 and prior. The application fails to validate that the dataset prompts and variations being accessed or modified belong to the requesting user's organization or project. An authenticated attacker can exploit this by sending crafted network requests to create, update, or delete prompt variations for datasets they do not own. This can result in unauthorized data access and loss of data integrity for AI training and testing datasets. The issue was addressed in version 1.4.9.

Affected products

lunary-ai lunary up to 1.4.8

Timeline

2024-06-09: disclosed
2024-06-10: advisory
2024-06-10: patched: Fixed in version 1.4.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.