sentry 9.1.2 vulnerabilities

Known vulnerabilities in the sentry package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Authentication Bypass Using an Alternate Path or Channel Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to a race condition in `handle_async_deletion()`, invoked during the authorization flow. An attacker who can convince a user to authorize an app can maintain unauthorized access to user accounts by generating multiple valid authorization codes, even after the application has been de-authorized. Note: This vulnerability has been fixed in self-hosted Sentry version 25.5.0. How to fix Authentication Bypass Using an Alternate Path or Channel? A fix was pushed into the `master` branch but not yet published.	[0,)
M Server-Side Request Forgery (SSRF) Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via Phabricator integration, which does not properly sanitize input. An attacker could exploit this by making the application send POST HTTP requests to arbitrary URLs, including internal IP addresses. This could allow the attacker to interact with the internal network or scan local/remote ports. Note: This is only exploitable if an attacker has access to a Sentry instance. How to fix Server-Side Request Forgery (SSRF)? A fix was pushed into the `master` branch but not yet published.	[9.1.0,)
M Improper Authentication Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. How to fix Improper Authentication? A fix was pushed into the `master` branch but not yet published.	[0,)
H Improper Authorization Affected versions of this package are vulnerable to Improper Authorization such that an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. Note: The user does not need to be a member of the organization or have permissions on the project. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. How to fix Improper Authorization? Upgrade `sentry` to version 23.5.2 or higher.	[8.21.0,23.5.2)
M Regular Expression Denial of Service (ReDoS) Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regex in `FIELD_REGEX` and `TAG_REGEX`. Exploiting this vulnerability is possible by providing a string containing a lot of underscores. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `sentry` to version 22.6.0 or higher.	[,22.6.0)
M Open Redirect Affected versions of this package are vulnerable to Open Redirect via the 'API Applications' feature. The issue lies in the OAuth endpoint created by the 'API Applications' feature. When an error occurs during the OAuth processing, the application redirects to the user-specified URL without any confirmation. This allows an attacker to conduct phishing attacks, or chain it with other bugs to elevate impact. How to fix Open Redirect? Upgrade `sentry` to version 20.12.1 or higher.	[0,20.12.1)

Vulnerability

Vulnerable Version

Authentication Bypass Using an Alternate Path or Channel

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to a race condition in handle_async_deletion(), invoked during the authorization flow. An attacker who can convince a user to authorize an app can maintain unauthorized access to user accounts by generating multiple valid authorization codes, even after the application has been de-authorized.

Note: This vulnerability has been fixed in self-hosted Sentry version 25.5.0.

How to fix Authentication Bypass Using an Alternate Path or Channel?

A fix was pushed into the master branch but not yet published.

[0,)

Server-Side Request Forgery (SSRF)

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via Phabricator integration, which does not properly sanitize input. An attacker could exploit this by making the application send POST HTTP requests to arbitrary URLs, including internal IP addresses. This could allow the attacker to interact with the internal network or scan local/remote ports.

Note:

This is only exploitable if an attacker has access to a Sentry instance.

How to fix Server-Side Request Forgery (SSRF)?

A fix was pushed into the master branch but not yet published.

[9.1.0,)

Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account.

How to fix Improper Authentication?

A fix was pushed into the master branch but not yet published.

[0,)

Improper Authorization

Affected versions of this package are vulnerable to Improper Authorization such that an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID.

Note:

The user does not need to be a member of the organization or have permissions on the project.

Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action.

How to fix Improper Authorization?

Upgrade sentry to version 23.5.2 or higher.

[8.21.0,23.5.2)

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regex in FIELD_REGEX and TAG_REGEX. Exploiting this vulnerability is possible by providing a string containing a lot of underscores.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade sentry to version 22.6.0 or higher.

[,22.6.0)

Open Redirect

Affected versions of this package are vulnerable to Open Redirect via the 'API Applications' feature. The issue lies in the OAuth endpoint created by the 'API Applications' feature. When an error occurs during the OAuth processing, the application redirects to the user-specified URL without any confirmation. This allows an attacker to conduct phishing attacks, or chain it with other bugs to elevate impact.

How to fix Open Redirect?

Upgrade sentry to version 20.12.1 or higher.

[0,20.12.1)

sentry@9.1.2 vulnerabilities

A realtime logging and aggregation server.

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?