Lunary Broken Access Control Vulnerability Allowing Unauthorized Template Modification

A broken access control vulnerability exists in Lunary AI's Lunary application, specifically in versions 1.2.7 prior to 1.4.2. This vulnerability allows authenticated attackers to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. The issue arises from insufficient access controls, enabling attackers to manipulate template data across user accounts.

Impact

Exploitation of this vulnerability allows for unauthorized modification of any user's templates within the application.

Reproduction

To reproduce this vulnerability, log in as an authenticated user (attacker) and obtain a JSON Web Token (JWT) for authorization. Then, send a POST request to the /v1/templates/{id}/versions endpoint, including the JWT in the Authorization header. The request must contain a payload that specifies the template content and other relevant details. This request will then modify the template of the user whose ID was specified in the endpoint.

Remediation

Users can update to Lunary version 1.4.3 or later, where this vulnerability has been fixed.