sentry@23.6.0 vulnerabilities

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Integration platform integration which allows the storage of arbitrary HTML tags. An attacker can execute arbitrary scripts in the context of a user's browser by sending an unsanitized payload that is subsequently rendered on the Issues page. This is only exploitable if untrustworthy Integration platform integrations send external issues to the Sentry instance.

Note:

This vulnerability was fixed in version 24.7.1.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via Phabricator integration, which does not properly sanitize input. An attacker could exploit this by making the application send POST HTTP requests to arbitrary URLs, including internal IP addresses. This could allow the attacker to interact with the internal network or scan local/remote ports.

Note:

This is only exploitable if an attacker has access to a Sentry instance.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Access Control Bypass via the /api/0/api-tokens/ endpoint. An attacker can obtain a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to incorrectly returning the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation.

Note:

This only affects installations that have system.base-hostname option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.

Upgrade sentry to version 23.6.2 or higher.