You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability.
An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to:
interact with internal network;
scan local/remote ports.
Patches
The issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8, 2024.
Package and Versions
Package:
sentry
Affected Version(s):
>=9.1.0, <24.1.2
Patched Version(s):
24.1.2
Description / Impact
Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability.
An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to:
Patches
The issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8, 2024.
Workarounds
There are no known workarounds.
CVSS 3.1 Score and Vector
CVSS Score:
4.3
CVSS Vector:
3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
The text was updated successfully, but these errors were encountered: