Design/Logic Flaw

2023-11-3005:15:00

PRIOn knowledge base

www.prio-n.com

symbolicator

symbolication service

http endpoint

internal ip addresses

sentry instance

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.3%

JSON

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

CPENameOperatorVersion
symbolicatorge0.3.3
symbolicatorlt23.11.2

CPE	Name	Operator	Version
	symbolicator	ge	0.3.3
	symbolicator	lt	23.11.2

References

github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a

github.com/getsentry/symbolicator/pull/1332

github.com/getsentry/symbolicator/releases/tag/23.11.2

github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6