CVE-2024-3760: Lunary forgot-password rate-limit absence leading to mail bombing

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: Mail bombing: rate-limit absent on forgot-password page in lunary-ai/lunary - Report Date: April 14, 2024 - Vulnerability Type: CWE-770: Allocation of Resources Without Limits or Throttling - Severity: High (7.5) - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High 2. Vulnerability Impact: - User Account Disruption: Target user accounts may be overwhelmed by a large volume of password reset emails, making it difficult to manage and identify legitimate emails. The flood of reset emails may cause confusion and frustration. - Mail Server Performance and Availability: Mail servers processing a large number of password reset emails may consume significant resources, leading to performance degradation and slower email delivery. In severe cases, the mail server may become unresponsive or unavailable, affecting the entire organization’s email service. 3. Exploitation Method: - Automate forgot-password requests and send them to Burp. - Use Intruder to send requests and select User-Agent. - Launch the attack. - Check if the target email address is flooded with emails. 4. Vulnerability Status: - Fixed - Published - Assigned to lunary-ai/lunary team - Verified - Disclosure bounty awarded - Fix bounty awarded 5. Discoverer and Fixer: - Discoverer: antonin36330 - Fixer: Hugues Chocart 6. Vulnerability ID: CVE-2024-3760 7. Affected Version: 1.2.7 8. Bounty Information: - Disclosure Bounty: $450 - Fix Bounty: $112.50 This information provides a detailed overview of the vulnerability, including its description, impact, exploitation method, status, discoverer and fixer, bounty details, and affected version.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-3760: Lunary forgot-password rate-limit absence leading to mail bombing