Listen to this Post
The CVE-2025-4779 vulnerability affects lunary-ai/lunary versions before 1.9.24. It is a stored cross-site scripting (XSS) flaw in the `v1/runs/ingest` endpoint. An unauthenticated attacker can exploit this by sending a HTTP POST request with a malicious payload. The attack involves adding an empty `citations` field to the request data. This empty field triggers a specific code path within the application’s frontend. In this path, the React function `dangerouslySetInnerHTML` is used to render content. `dangerouslySetInnerHTML` directly sets HTML without React’s usual XSS escaping. The attacker-controlled text from the `citations` field is passed to this function. Due to lack of input sanitization, arbitrary HTML and JavaScript can be injected. The malicious script is then stored on the server’s database. When other users load pages that display this ingested run data, the script executes. Execution occurs in the victim’s browser session context. This allows the attacker to steal session cookies and authentication tokens. It can lead to full session hijacking and account compromise. Sensitive user data can be exfiltrated to attacker-controlled servers. The vulnerability can also be used to perform actions on behalf of the user. This includes modifying settings or initiating unauthorized operations. The root cause is improper validation of user-supplied data in citations. The use of `dangerouslySetInnerHTML` for untrusted input is the primary flaw. The fix in version 1.9.24 involves sanitizing input or using safe React methods.
Platform: lunary-ai/lunary
Version: prior to 1.9.24
Vulnerability: stored XSS
Severity: Critical
Date: 2025-07-07
Prediction: Patched in 1.9.24
What Undercode Say:
Analytics
Check if a lunary instance is vulnerable by probing the version.
curl -s http://target.com/api/version | grep “1.9.23”
Example malicious payload for the ingest endpoint.
curl -X POST http://target.com/v1/runs/ingest -H “Content-Type: application/json” -d ‘{“citations”: [], “input”: ““}’
Scan for exposed endpoints using common paths.
gobuster dir -u http://target.com -w /usr/share/wordlists/common.txt
How Exploit:
1. Identify a lunary instance below version 1.9.24.
- Craft a POST request to /v1/runs/ingest with a citations array containing an empty string or malicious script.
- Inject JavaScript payload like .
- The payload is stored and executed when users view the run details.
5. Attacker receives session cookies via webhook.
Protection from this CVE
Update to version 1.9.24.
Sanitize all user inputs.
Avoid dangerouslySetInnerHTML.
Implement Content Security Policy.
Impact:
Session hijacking possible.
Data theft from users.
Unauthorized actions performed.
Low attack complexity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
