CVE-2024-1738 (published 2024-04-16T00:15Z)

An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.


Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/lunary-ai/lunary
commit_details: repo_url: https://github.com/lunary-ai/lunary
author: Hugues Chocart
author_date: 2024-04-06 11:12:59-03:00
msg: fix: get evaluation result (#181)
repository: repo_url: https://github.com/lunary-ai/lunary
repo_name: lunary-ai/lunary
description: The production toolkit for LLMs. Observability, prompt management and evaluations. 
repo_language: TypeScript
owner: lunary-ai
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@
     "start:ml": ". ./packages/ml/venv/bin/activate && python3 packages/ml/main.py",
     "build:frontend": "npm -w packages/frontend run build",
     "migrate:db": "npm -w packages/backend run migrate:db",
-    "dev": "concurrently \"npm run dev:frontend\" \"npm run dev:backend\" \"npm run dev:radar\"",
+    "dev": "concurrently \"npm run dev:frontend\" \"npm run dev:backend\"",
     "dev:frontend": "npm -w packages/frontend run dev",
     "dev:backend": "npm -w packages/backend run dev",
     "dev:radar": "npm -w packages/backend run dev:radar",

programming_language: JavaScript
filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -122,17 +122,21 @@ evaluations.get(
   checkAccess("evaluations", "read"),
   async (ctx: Context) => {
     const { evaluationId } = ctx.params
+    const { projectId } = ctx.state
 
     const results = await sql`
-  select 
-    *,
-    p.id as prompt_id
-  from 
-    evaluation_result er 
-    left join dataset_prompt p on p.id = er.prompt_id
-    left join dataset_prompt_variation pv on pv.id = er.variation_id
-  where 
-    er.evaluation_id = ${evaluationId}`
+      select 
+        *,
+        p.id as prompt_id
+      from 
+        evaluation_result er 
+        left join evaluation e on e.id = er.evaluation_id
+        left join dataset_prompt p on p.id = er.prompt_id
+        left join dataset_prompt_variation pv on pv.id = er.variation_id
+      where 
+        er.evaluation_id = ${evaluationId}
+        and e.project_id = ${projectId}
+      `
 
     ctx.body = results
   },

programming_language: TypeScript