New Relic: Bypassing Protection Mechanism: Change of Account Name after Session Log out

The researcher illustrated a delay in session invalidation. This has not been added to our public policy to help prevent confusion...

New Relic: Secure credentials values disclosure to regular users due to access control issue in monitor creating function

@skavans discovered a test endpoint for Syntethics monitors that did not properly validate the permissions of the user making the request. This could allow lesser privileged users on the same to account create monitors using Secure Credentials...

New Relic: Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

@skavans identified an endpoint for testing Synthetics monitors. Without proper validation, this could allow monitors from other accounts to run on your account with knowledge of the monitor's ID: POST /accounts//monitors/monitor/recheck.json?monitorId= HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Attacker can create new account inside any partnership with no approve from the Partnership owner

@skavans discovered a way to link an account with an arbitrary Partnership with a known ID. Validation was added to prevent linking to unintended partnerships...

New Relic: Ability to buy PRO subscriptions by arbitrary reduced prices

Hey team, I've found that a malicious user can buy PRO subscriptions by arbitrarily reduced prices. Steps to reproduce 0 Make sure you have an account without subscriptions at APM PRO bought. If you don't – register a new one. It works for me inside the EU accounts at least. 1 Sign in this accoun...

New Relic: Account owner/admin can't actually delete personal users' API keys

Hey team, An account owner/admin should be able to remove API keys belonging to other users in a case of, for instance, they are compromised. This sentence is confirmed by your own docs: F695035 However, the account owner/admin can't actually do this so he can't protect the account data from bein...

New Relic: Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

Hey team, I've found that Restricted user can update Apdex target for applications by leveraging the GraphQL mutation which doesn't properly implement authorization. Steps to reproduce 1 Sign in NR with Restricted user 2 Navigate to https://api.newrelic.com/graphiql, intercept the request to...

New Relic: Cross-account reading of Insights dashboards through GraphQL

@skavans identified a GraphQL query lacking validation. This had the potential to return a subset of Insights dashboards in target accounts...

New Relic: NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

Hey guys, While working at 746786, I've discovered a NewRelic-wide huge CORS-policy misconfiguration leading to cross-account data stealing and modification at a huge amount of endpoints. The vulnerability itself is that origin nr3.nr-assets.net is trusted NR-widely at many different endpoints, b...

New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...

New Relic: [Bypass] Code injection to open redirect in https://insights.newrelic.com/accounts/2521182/dashboards/1026927

INTRODUCES: Overcoming mechanism of controlling url insertion, redirecting users to fake pages STEPS: Payload: Add dashboard note and insert code malicious. Code : Click link to view note detail : Impact Redirecting users to malicious pages, stealing user information such as fake scripts and user...

New Relic: Cross-account stored XSS at notes (through "swf" note parameter)

Hey team, I've found one more stored XSS, this one is inside a note. Since notes could be published to be available for any NR user cross-accountly, the impact is quite severe. You can see the publicly-available payload here: https://rpm.newrelic.com/public/notes/4qovMmDXV7P F603334 Steps to...

New Relic: Cross-account stored XSS at embedded charts

Hey team, I've discovered one more stored XSS, this one is at the embedded chart page. Steps tp reproduce 1 Sign into NR, navigate to any Mobile app - Interactions 2 Click ... near any chart, then choose Embed. Select OK at the confirm box. 3 Intercept the chart embedding POST request: http POST...

New Relic: Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

Hey team, I've discovered an improper user-input filtration issue at charts embedding herald.service.newrelic.com leading to both cross-account stored XSS and SSRF. There is an action Get chart link for some charts for instance, for the ones located at Mobile - Overview. F600887 After user clicks...

New Relic: Stored XSS at Mobile (Versions tab)

Hey team, I've discovered stored XSS rendered at Mobile inside the Versions tab working at least at latest Safari and latest Chrome MacOS. Steps to reproduce: 1 Sign into Mobile with some account which can edit the mobile applications 2 Navigate to some active mobile app, then go to Settings -...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

New Relic: Can fake content email of newrelic to any user

@lamscun reported an issue where an arbitrary account name, including special characters and anchor tags, would show up in an invitation email. While we've seen this issue several times, we've decided not to change how account names are formatted. Ultimately, the email client determines how the...

New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

New Relic: User can run monitors at private locations, which he has no access to

@skavans discovered that insufficient validation was performed when configuring Synthetics monitors allowing deployment to arbitrary private locations with knowledge of the location ID: POST /accounts//validation.json HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Stored XSS at APM transaction map (transactionName field)

Hey team, You've recently fixed my previous report about transaction map stored XSS 549084 and the fix is correct, I wasn't successful with finding a bypass. But I've discovered another vulnerable transaction map field transactionName. An attacker can inject a payload inside this field and then,...