Vulnerability · Published Feb 8, 2024 · Assigned by GitHub_M

CVE-2024-24829SSRF in Sentry via Phabricator integration

Medium 4.3

In plain English

A medium-severity server-side request forgery in sentry from getsentry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
getsentry	sentry	>= 9.1.0, < 24.1.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/getsentry/sentry/security/advisories/GHSA-rqxh-fp9p-p98r x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/64882 x_refsource_MISC
https://github.com/getsentry/self-hosted/releases/tag/24.1.2 x_refsource_MISC