CVE-2024-9095

Summary

CVE-2024-9095 is a vulnerability affecting the lunary-ai/lunary package in version 1.4.28. The issue lies in the unsecured /bigquery API route, which allows any authenticated user to create Datastreams to Google BigQuery and export the entire database. This action can expose sensitive data, such as password hashes and secret API keys, posing risks of data breaches, credential compromise, and service disruptions. The route is protected by a configuration check, but it fails to verify user access levels and implement proper access control middleware.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.