CVE-2024-7456
Published: 01 November 2024
Summary
CVE-2024-7456 is a critical-severity SQL Injection (CWE-89) vulnerability in Lunary Lunary. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: Obtain Capabilities (AML.T0016), AI Supply Chain Compromise (AML.T0010), Exfiltration via AI Inference API (AML.T0024).
Deeper analysis
A SQL injection vulnerability affects the /api/v1/external-users route in lunary-ai/lunary version 1.4.2. The flaw stems from an order-by clause that invokes sql.unsafe on an orderByClause variable built without server-side validation or sanitization, allowing arbitrary SQL commands to be executed.
An unauthenticated attacker with network access can supply a malicious order-by parameter to the endpoint and achieve full read, write, or destructive operations against the database, resulting in data exfiltration, modification, or complete loss.
The referenced commit 6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e in the lunary repository addresses the issue by removing the unsafe SQL construction; practitioners should apply the corresponding patch or upgrade to a fixed release. The associated huntr report documents the same root cause and remediation path.
The EPSS score has reached a peak of 0.2969 with a current value of 0.2925, indicating moderate and relatively stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48378
Vulnerability details
A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is constructed without server-side validation or sanitization,…
more
enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Lunary.ai is an open-source observability platform for LLM/AI applications, fitting 'Other Platforms' as it is an AI/ML-related platform not matching more specific categories like frameworks or libraries. The vulnerability is in its API, confirmed AI-related via AI/ML bug bounty context.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing API (/api/v1/external-users) enables exploitation of public-facing application (T1190), collection from databases (T1213.006), stored data manipulation including corruption and modification (T1565.001), and data destruction leading to complete data loss (T1485).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.