Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-6862

CVE-2024-6862: Lunary Cross-Site Request Forgery (CSRF) vulnerability

7.4

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-6862
GHSA ID
GHSA-v6x6-4v4x-2fx9
EPSS Score
0.21346%
CWE
CWE-352
Published
9/13/2024
Updated
9/13/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
lunarynpm< 1.4.101.4.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the CORS middleware implementation in patchedCors function. The pre-patch version: 1) Used client-supplied Origin header without validation (allowing '*' fallback) 2) Applied this permissive policy to OPTIONS requests and general CORS configuration 3) Lacked environment-specific restrictions (only fixed in production after patch). The commit shows these flaws were addressed by introducing environment checks (NODE_ENV) and using a fixed APP_URL in production rather than client-controlled values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *ross-Sit* R*qu*st *or**ry (*SR*) vuln*r**ility *xists in lun*ry-*i/lun*ry v*rsion *.*.** *u* to ov*rly p*rmissiv* *ORS s*ttin*s. T*is vuln*r**ility *llows *n *tt**k*r to si*n up *or *n* *r**t* proj**ts or us* t** inst*n** *s i* t**y w*r* * us*r wi

Reasoning

T** vuln*r**ility st*ms *rom t** *ORS mi**l*w*r* impl*m*nt*tion in p*t*****ors *un*tion. T** pr*-p*t** v*rsion: *) Us** *li*nt-suppli** Ori*in *****r wit*out v*li**tion (*llowin* '*' **ll***k) *) *ppli** t*is p*rmissiv* poli*y to OPTIONS r*qu*sts *n*