In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a viewer role can exploit this vulnerability to hijack another users account by obtaining the password reset token. The vulnerability is triggered when the viewer role user sends a specific request to the server, which responds with a password reset token in the recoveryToken parameter. This token can then be used to reset the password of another users account without authorization. The issue results from an excessive attack surface, allowing lower-privileged users to escalate their privileges and take over accounts.
Weakness
The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lunary | Lunary | * | 1.2.14 (excluding) |
Extended Description
Originating from software security, an “attack surface” measure typically reflects the number of input points and output points that can be utilized by an untrusted party, i.e. a potential attacker. A larger attack surface provides more places to attack, and more opportunities for developers to introduce weaknesses. In some cases, this measure may reflect other aspects of quality besides security; e.g., a product with many inputs and outputs may require a large number of tests in order to improve code coverage.