CVE-2024-7472: Lunary Email Injection Vulnerability

CVE-2024-7472 is an email injection flaw in Lunary v1.2.26 affecting email verification and signup APIs. Attackers can inject malicious content into emails, enabling phishing attacks and brand damage. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-7472 Overview

CVE-2024-7472 is an email injection vulnerability in lunary-ai/lunary version 1.2.26. The flaw affects the Send email verification API (/v1/users/send-verification) and the Sign up API (/auth/signup). An unauthenticated attacker can bypass the extractFirstName function by submitting a non-standard whitespace character such as \\xa0 (non-breaking space). This allows injection of attacker-controlled data into outgoing emails sent by the application. The classification maps to [CWE-93] Improper Neutralization of CRLF Sequences and [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
Attackers can inject arbitrary content into outbound verification emails, enabling phishing campaigns that abuse the Lunary brand and sending infrastructure.

Affected Products

lunary-ai/lunary version 1.2.26
Deployments exposing /v1/users/send-verification
Deployments exposing /auth/signup

Discovery Timeline

2024-10-29 - CVE-2024-7472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7472

Vulnerability Analysis

The vulnerability lives in how Lunary derives a recipient's first name from user-controlled input before composing a verification email. The extractFirstName function tokenizes the submitted name using standard whitespace rules. Attackers can substitute an alternative whitespace character, such as a non-breaking space (\\xa0), to defeat the parser. The remaining payload is then treated as a single name token and embedded verbatim into the outgoing email body or headers.

Because both /auth/signup and /v1/users/send-verification accept unauthenticated requests, any remote attacker can trigger the email flow. The application sends the resulting message from the legitimate Lunary mail infrastructure, lending it strong deliverability and brand trust.

Root Cause

The root cause is reliance on a whitespace-based parser (extractFirstName) that does not normalize Unicode whitespace categories before splitting input. The function treats \\xa0 and similar characters as non-delimiters, allowing injected payloads to survive sanitization and reach the email template.

Attack Vector

An unauthenticated attacker issues an HTTP request to /auth/signup or /v1/users/send-verification containing a crafted name field. The field includes a non-breaking space followed by injected content such as phishing text, URLs, or additional MIME content. Lunary accepts the registration, invokes extractFirstName, and dispatches an email that contains the injected material to a victim address the attacker chooses. User interaction is required to act on the phishing content, consistent with the CVSS vector.

For the full proof of concept, see the Huntr Bounty Report.

Detection Methods for CVE-2024-7472

Indicators of Compromise

Signup or verification requests containing non-ASCII whitespace characters (\\xa0, \\u2007, \\u202F) in the name field.
Unusually long name values submitted to /auth/signup or /v1/users/send-verification.
Outbound Lunary verification emails whose rendered first-name field contains URLs, HTML, or additional recipients.
Spikes in verification email volume to external domains not associated with legitimate users.

Detection Strategies

Inspect HTTP request bodies to Lunary signup endpoints for Unicode whitespace categories outside U+0020 and U+0009.
Correlate signup events with outbound SMTP logs to identify disproportionate email sends from a single source IP.
Alert on outbound mail bodies that contain unexpected hyperlinks or control characters in templated greeting fields.

Monitoring Recommendations

Enable application-level logging of raw name parameters submitted to both affected endpoints.
Monitor SMTP relay reputation and bounce rates for the Lunary sending domain for sudden degradation.
Review web application firewall telemetry for repeated unauthenticated requests to the verification APIs.

How to Mitigate CVE-2024-7472

Immediate Actions Required

Upgrade lunary-ai/lunary beyond version 1.2.26 to a release containing commit a39837d.
Audit outbound mail logs since deployment of 1.2.26 for evidence of injected phishing content.
Rate-limit unauthenticated requests to /auth/signup and /v1/users/send-verification at the reverse proxy.

Patch Information

The maintainers addressed the issue in commit a39837d7c49936a0c435d241f37ca2ea7904d2cd. The fix updates the name parsing logic so that alternative whitespace characters no longer bypass sanitization before the value reaches the email template.

Workarounds

Place a WAF rule in front of Lunary that rejects requests containing non-ASCII whitespace in the name parameter.
Strip or Unicode-normalize (NFKC) the name field at an upstream API gateway before forwarding to Lunary.
Temporarily disable self-service signup if patching cannot be completed quickly.

bash

# Example ModSecurity rule to block non-breaking space in signup payloads
SecRule REQUEST_URI "@rx ^/(auth/signup|v1/users/send-verification)$" \
  "id:1007472,phase:2,deny,status:400,\
   chain,msg:'CVE-2024-7472 email injection attempt'"
  SecRule REQUEST_BODY "@rx [\\xc2\\xa0\\xe2\\x80\\x87\\xe2\\x80\\xaf]" \
    "t:none"