New Relic: GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted user

Overview As a restricted user, you cannot view the main account license key. If you are logged into your restricted user account, and visit https://support.newrelic.com/, when you attempt to create a ticket the root account license key will be exposed in the request. Steps to Reproduce 1. From a...

New Relic: IDOR allows accounts to view full name of other accounts based on email through share notes feature

This is a similar IDOR that I've reported in the past - but now that "anything goes" is in scope I looked around and tried to find other areas within the application that this might exist in. And I found it while sharing a note: Steps to Reproduce From new user creation page: 1. Add a new user to...

New Relic: Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter

NR Alerts gives you the granularity to set alert conditions on an alert policy depending on the conditions you specify at the https://alerts.newrelic.com/accounts/ACCOUNTNUMBER/policies/POLICYID/conditions/new URL. When you select an entity for the condition, the application does not check to...

New Relic: The impossibility of inclusion of the trial (BROWSER)

Hello! Found a problem that reveals a query in the newrelic database in connection with receiving a server error on a normal domain https://rpm.newrelic.com/browser/id this is not! The problem is that I can't run the trial version through the EU. Getting 500-server message: "Internal Server Error...

New Relic: [NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint

An IDOR exists allowing me to change the filter settings of any account on New Relic through the following PUT request: PUT /internalapi/1/accounts/1523936/dashboards/687944/filter HTTP/1.1 Host: insights.newrelic.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.14; rv:63.0 Gecko/20100101...

New Relic: Upgrade menu exposes the mobile application token meant to only be visible to administrators

Usually, the restricted user is not able to view the mobile application token for a mobile app - the page that this token is visible on is only accessible to administrators. However - there exists a workaround to this if you are a restricted user and you still want to obtain this token - simply...

try.newrelic.com XSS vulnerability

Open Bug Bounty ID: OBB-695965 Description| Value ---|--- Affected Website:| try.newrelic.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

New Relic: Swiftype key stored in JavaScript source

Hi, I am surfing on the newrelic website. I found a sensitive data including authentication key written in public accessible javascript file. Some 3rd party solution SwiftType newrelic using for crawling or search/suggestion. below is the link where you can find the authkey. which would be able t...

New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...

New Relic: WordPress username enumeration (/author)

@rootbakar identified a previously-reported issue where authors could be viewed from an endpoint within our WordPress blog. As authors are intended to be public, this was closed as not having any security impact to the blog...

New Relic: [NR Infrastructure] Restricted user can update integration provider account name via integrations API

NR Infra allows you to create a GCP integration and set a custom name. By default, the restricted user account can't change anything associated associated with this type of infra integration, but there is a missing check on changing the name of the integration through the integrations API. Observ...

New Relic: [NR Insights] Pull any Insights/NRQL data from any NR account

@jonbottarini discovered an issue where a feature within a cloud integration wasn't properly validating account IDs. This report helped us identify a backend issue that could prevent account validation from taking place in certain situations. This was a fun one! The full writeup is for this bug i...

New Relic: DNS misconfiguration on email.alerts.newrelic.com

While checking the subdomains i found that the subdomain email.alerts.newrelic.com upon navigating downloads a file saying "Mailgun Magnificent API" And has the following DNS info screenshot attached The problem lies in this issue: You add the domain email.alerts.newrelic.com to Mailgun Mailgun...

New Relic: [NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app

In NR Insights, there is the ability to set a permissions for the data app itself. It's located here: F326634 Now, in this section, if a user creates a new data app and sets the permissions to "visible to others within my account" it essentially provides read-only access to the data app and its...

New Relic: NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

@jonbottarini identified an issue where our permissions for Synthetics didn't match the permissions elsewhere in our product. This eventually led to a change in our underlying permissions code to unify our products and prevent issues like this...

New Relic: [NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions

This bug requires a bunch of pre-setup, and a few conditions to make it work, but I'll do my best to write it out without making this a novel. You will need: 1. Account that is an admin 2. Account that is a "Restricted" user, without any synthetics permissions so, can't view monitors, can't edit...

New Relic: Restricted user can bypass permissions restriction to create NR Alert policies

So this one is similar to my other privilege escalation issues, but it comes with a sidenote which may lead to some more interesting issues if you feel like digging into it. Issue: User with read only privileges can create NR Alert policies through POST request to Infrastructure-Data service...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

New Relic: IDOR via internal_api "users" endpoint

While trying to figure out what the heck is going on with 347664, I stumbled upon another way to perform the "gift that keeps on giving" as @ahamlin put it. Steps to reproduce: 1. Add a unconfirmed user to your account 2. Navigate to https://alerts.newrelic.com/accounts/1523936/channels 3. Click ...

New Relic: Stored XSS in Brower `name` field reflected in two pages

The Name field of the Brower apps feature is not properly escaped in at least two pages. An attacker can create a new browser application with a specially crafted Name field which will be reflected and interpreted by other users visiting these two pages. Leveraging this vulnerability, I was able ...