Cyber Posture

CVE-2024-8998

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
04 April 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0036 58.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2024-8998 is a Regular Expression Denial of Service (ReDoS) vulnerability in the lunary-ai/lunary server at commit git f07a845. The issue stems from the regex pattern /{.*?}/ applied to user-controlled strings, which exhibits polynomial-time complexity in the default JavaScript regex engine when processing certain crafted inputs. This affects the server's ability to process requests efficiently, as rated by a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and mapped to CWE-1333.

Any unauthenticated remote attacker can exploit this vulnerability by submitting a specially crafted payload that triggers excessive backtracking in the regex engine. Successful exploitation causes the server to hang for an arbitrary duration, resulting in a denial of service that impacts availability without requiring privileges or user interaction.

The vulnerability is fixed in lunary-ai/lunary version 1.4.26, as detailed in the patching commit at https://github.com/lunary-ai/lunary/commit/f2bfa036caf2c48686474f4560a9c5abcf5f43b7. Additional details are available via the Huntr advisory at https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e. Security practitioners should upgrade to the patched version and review regex usage in Node.js applications for similar ReDoS risks.

Details

CWE(s)
CWE-1333

Affected Products

lunary
lunary
≤ 1.4.26

AI Security Analysis

AI Category
Other Platforms
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
Lunary-ai/lunary is an open-source observability and evaluation platform for AI/LLM applications, fitting as an 'Other Platforms' category for AI infrastructure tools.

MITRE ATT&CK Enterprise Techniques

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

ReDoS vulnerability enables crafted input to trigger polynomial-time regex matching, causing server CPU exhaustion and hang, facilitating application exploitation for endpoint DoS.

References