Lucene search

GitHub Advisory DatabaseGHSA-4XQM-4P72-87H6

HistoryJul 06, 2023 - 10:55 p.m.

Sentry CORS misconfiguration

2023-07-0622:55:44

CWE-697

CWE-863

CWE-942

GitHub Advisory Database

github.com

sentry

api

cors

vulnerability

base hostname

misconfiguration

patch

upgrade

installation

saas

self-hosted

workarounds

browser

cookie blocking

multi-step attacks

github

credit

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

32.0%

JSON

Impact

The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default.

Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.

Patches

The patch has been released in Sentry 23.6.2.

Workarounds

For Sentry SaaS customers, no action is needed.

For self-hosted Sentry installations that have system.base-hostname explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.