Lunary AI CVE-2024-3379 Unauthorized Private Key Regeneration

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: unprivileged user can re-generate private key for project in lunary-ai/lunary - Vulnerability Type: BUG - Description: An unprivileged user can regenerate a project's private key. 2. Reproduction Steps: 1. Create an admin account named user-A. 2. Log in to user-A and add another user, user-B, with the "Member" role. 3. From user-A, create a project named Project-A. Do not assign this project to user-B. 4. Log in to user-B’s account. User-B cannot access Project-A. 5. User-B sends a request to regenerate the private key for the above project. 3. Vulnerability Request: - Request: - Headers: - - - - - - - - - - - - Body: 4. Impact: - An unprivileged user can regenerate a project’s private key. 5. Vulnerability Status: - The vulnerability has been fixed. - CVE ID: CVE-2024-3379 - Affected Version: 1.2.2 - Fixed Version: 1.2.7 - Reporter: ranjit-git - Fixer: Hugues Chocart 6. Reward Information: - Disclosure Reward: $900 - Fix Reward: $225 7. Timeline: - Report Submitted: April 5, 2024 - Vulnerability Verified: July 2024 - Vulnerability Fixed: July 2024 - Vulnerability Publicly Disclosed: July 2024 8. Community Interaction: - User Hugues Chocart verified and fixed the vulnerability and received the fix reward. - User ranjit-git received the disclosure reward. - User Hugues Chocart received the fix reward. This information provides a detailed overview of the vulnerability’s nature, reproduction steps, impact, and remediation, aiding in understanding its severity and resolution.

Goal Reached Thanks to every supporter — we hit 100%!

Lunary AI CVE-2024-3379 Unauthorized Private Key Regeneration