ExploitCVE-2024-7472
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)
Summary
lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.
Impact
The vulnerability allows an unauthenticated attacker to inject malicious content into outgoing emails. This can lead to several severe consequences: 1. Phishing attacks: Attackers can manipulate email content to deceive recipients, potentially leading to credential theft or malware installation. 2. Brand damage: Malicious emails sent from the organization's domain can harm its reputation and trustworthiness. 3. Legal and compliance issues: Unauthorized email manipulation may violate data protection regulations and privacy laws. 4. Financial impact: Unauthorized use of the email system can result in increased costs and potential fines from regulatory bodies. The CVSS base score of 6.5 (Medium severity) indicates a significant risk, especially considering the potential for widespread impact through email-based attacks.
Exploitation
One proof-of-concept exploit is available on huntr.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in a commit on GitHub (https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd) as of October 31, 2024.
Mitigation
1. Update lunary-ai/lunary to a version newer than 1.2.26 that includes the security fix. 2. Implement input validation and sanitization for all user-supplied data, especially in email-related functions. 3. Use a robust email templating system that properly escapes special characters. 4. Implement additional security measures such as rate limiting and logging for email-related APIs. 5. Regularly audit and test email-related functionalities for potential injection vulnerabilities. 6. Consider implementing DMARC, SPF, and DKIM to improve email security and reduce the risk of email-based attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Timeline
NVD published the first details for CVE-2024-7472
Feedly found the first article mentioning CVE-2024-7472. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.9%)
A CVSS base score of 6.5 has been assigned.