Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-6867

CVE-2024-6867: Lunary information disclosure vulnerability

4.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-6867
GHSA ID
GHSA-9jmp-j63g-8x6m
EPSS Score
0.25069%
CWE
CWE-1220
Published
9/13/2024
Updated
9/13/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
lunarynpm< 1.4.101.4.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the route handler for the /runs/{id}/related endpoint. Analysis of the commit diff shows the original SQL query (lines 586-598) did not include 'project_id = ${projectId}' in the WHERE clause, allowing retrieval of runs from any project through parent_run_id relationships. The handler failed to properly scope results to the user's authorized project, violating access control requirements. The confidence is high as the fix explicitly adds project_id validation to constrain results.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n in*orm*tion *is*losur* vuln*r**ility *xists in t** lun*ry-*i/lun*ry, sp**i*i**lly in t** `runs/{run_i*}/r*l*t**` *n*point. T*is *n*point *o*s not v*ri*y t**t t** us*r **s t** n***ss*ry ****ss ri**ts to t** run(s) t**y *r* ****ssin*. *s * r*sult, i

Reasoning

T** vuln*r**ility st*ms *rom t** rout* **n*l*r *or t** /runs/{i*}/r*l*t** *n*point. *n*lysis o* t** *ommit *i** s*ows t** ori*in*l SQL qu*ry (lin*s ***-***) *i* not in*lu** 'proj**t_i* = ${proj**tI*}' in t** W**R* *l*us*, *llowin* r*tri*v*l o* runs *