Vulnerability · Published Nov 30, 2023 · Assigned by GitHub_M

CVE-2023-49094Symbolicator Server Side Request Forgery vulnerability

Medium 4.3

In plain English

A medium-severity server-side request forgery in symbolicator from getsentry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

Affected products (as reported)

Vendor	Product	Versions
getsentry	symbolicator	>= 0.3.3, < 23.11.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6 x_refsource_CONFIRM
https://github.com/getsentry/symbolicator/pull/1332 x_refsource_MISC
https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a x_refsource_MISC
https://github.com/getsentry/symbolicator/releases/tag/23.11.2 x_refsource_MISC