CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

CVE-2017-9246

CVE-2017-9246 affects New Relic .NET Agent (pre-6.3.123.0). The vulnerability arises from failure to escape quotes in Slow Queries, enabling SQL injection via an INSERT VALUES clause after bypassing a SET SHOWPLAN_ALL ON protection. Impact is high/critical per cited metrics, including HIGH confid...

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

New Relic: CSRF For Adding Users

Issue The API affected is https://rpm.newrelic.com/accounts/accountid/accountviews. Only admin users are allowed to add other new users, but a normal user with knowledge of the accountid can craft a webpage which does a CSRF when an admin user visits it. There are 2 problems with it that can resu...

New Relic: /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email"

Hello Team, Vulnerable Url: https://rpm.newrelic.com/accounts/USERID.json Description of the Bug: As Restricted user for an organization cannot Add New users to the Organization, cannot change Organization Name, cannot generate or download report as well as cannot read the information of Owner...

New Relic: Manipulation of submit payment request allows me to obtain Infrastructure Pro/Other Services for free or at greatly reduced price

@jonbottarini discovered an issue with our purchase process validation. This allowed subscription purchases to complete, even when they did not equal the intended price for the service provided. I wanted to test the New Relic pro features. I didn't want to pay full price I hacked the payment page...

New Relic: Privilege Escalation in Share Report

Hello, I would like to report about Privilege Escalation on synthetics.newrelic.com domain. You can enable report sharing for monitor without permission. In order to reproduce it, do the following steps: 1 Login as company administrator 2 Navigate to...

New Relic: Privilege Escalation in Default Notification Preferences

Hello, I would like to report about Privilege Escalation on rpm.newrelic.com domain. You can change other company's user default notification preferences. In order to reproduce it, do the following steps: 1 Login as company administrator 2 Navigate to...

New Relic: Unvalidated redirect in alerts.newrelic.com/auth/newrelic?origin=

Affected host: alerts.newrelic.com Affected resource: /auth/newrelic Affected GET parameter: origin PoC: 1. Go to https://alerts.newrelic.com/auth/newrelic?origin=.example.com 2. If you don't have an active session, you'll need to login with your New Relic credentials 3. You'll be taken to...

New Relic: Sensitive information disclosure

I am able to download ciritcal files which include newrelic environment setup, setting uo of database which also says which database is used etc. I am able to access this information using a google dork Google dork:site:newrelic.com ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw |...

New Relic: Directory listing - i am able to download all php_agent archive

While playing around to access some private information on newrelic.com i was able to get access to critical files which are not supposed disclose publically. i am able to download all archived files. Google Dork:site:newrelic.com intitle:index.of Real Proof:...

New Relic: [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpoint

Hi, While conducting New Relic web property reconnaissance, I came across the unused docs-ra.newrelic.com endpoint. This endpoint allowed an unauthenticated user to progress through the Drupal installation process and activate the site with their own configuration – it appears that valid MySQL...

New Relic: Open redirection

Hey, URL : https://rpm.newrelic.com/auth/newrelic?origin=http:/example.com/ To reproduce: 1 login 2 go to https://rpm.newrelic.com/auth/newrelic?origin=http:/example.com/ You will be redirected to http://example.com Thank you!...

New Relic: Broken Authentication and session management OWASP A2

@honc reported an issue with session expiration. We determined that this report was invalid, and it was self-closed by the researcher. Insufficient Session Expiration vulnerability...

New Relic: Restricted user is able to delete filter sets of admin users in https://infrastructure.newrelic.com/accounts/{{ACC#}}/settings/filterSets

At this endpoint: https://infrastructure.newrelic.com/accounts/████/settings/filterSets the application does not properly check to ensure that a user with restricted settings is able to delete filters of other users, including a filter of an admin. Step by step instructions 1. Admin creates a New...

New Relic: Logic flaw enables restricted account to access account license key

Hello - this is a resubmission of my report 197071 that was sent to the public NewRelic program. You have a serious logic flaw which results in a restricted account being able to view the account license key. This is able to be performed by logging into a restricted account, clicking on the...

New Relic: Restricted User is able to edit Alert Conditions of Synthetics Monitors even if Synthetics Permissions is enabled by an admin

In this vulnerability, a restricted user is able to edit the alert conditions of a synthetics monitor, even if he is unauthorized to do so. Steps to reproduce: - Admin user invites User1 to New Relic account as a restricted user - User1 accepts invitation, joins the account - Admin goes to...

New Relic: Moniter Failed Sends too many emails

Hello, While i was testing your program i found one vulnerabilty in your program, Steps To Reproduce 1. Go here https://newrelic.com/, and click on signup button. 2.Then put Javascript alert in Name field You can try any name too 3. Then put javascript:alertdocument.domain in You company field Yo...

New Relic: Stored XSS on BillingCountry parameter

Domain Affected:...

docs.newrelic.com XSS vulnerability

Vulnerable URL: https://docs.newrelic.com/search/node/%22%3E%3Cscript%3Ealert'OPENBUGBOUNTY'%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinat...