265 matches found
New Relic: Stored XSS through Angular Expression Sandbox Escape
As an Admin of an account, I am able to set the Name of the Account to an Angular expression. This Angular expressions is resolved and executed on the Insights Welcome Page for anyone that is apart of the Account. Due to the ability to invite anyone even current NewRelic users to an Account, it...
New Relic: Synthetics Xss
Hello New Relic Team , i have just found that i can add html code and it will be executed . the issue in https://synthetics.newrelic.com if you added a new monitor with the html code , for example " when you go to https://synthetics.newrelic.com/accounts/"accountnumber"/synthetics and search for ...
New Relic: Host Header Injection / Cache Poisoning
The application reflects HTTP Header value back in it's response and it may be possible to poison the server cache. The X-Forwarded-Host is directly reflected as a hyperlink. HTTP Request GET / HTTP/1.1 Host: newrelic.com X-Forwarded-Host: pavanw3b.com ... .... HTTP Response HTTP/1.1 200 OK...
New Relic: Normal user can set "Job title" of other users by Direct Object Reference
A normal user when logs in to "New Relic" and navigates to the "Account Settings" page, can only set his/her own Job title. All other user's Job title selection are not available. But using a proxy tool like Burp Suite, while changing his own job role, if he replaces his own ID with any other use...
New Relic: All the active session should destroy when user change his password
hello security, There is an user sessions issue on your application that should be fixed. Proof of Concept Suppose, you have an account on newrelic.com Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll do ? i...
New Relic: Open redirection on login
Hello, Domain : login.newrelic.com Endpoint : https://login.newrelic.com/login?returnto=URL Description : There is a protection against open redirection at this endpoint, so an attacker can't redirect an user to any external website using following :...
New Relic: no email confirmation on signup
the email confirmation is not taken anyone can make newrelic account from any email address...
New Relic: Emails and alert policies can be altered by malicious users.
Recreate Steps 1 Create Two Accounts 2 In separate browsers Firefox and Chrome log into each account and go to the edit page a https://rpm.newrelic.com/users//edit 3 Check one of the email or alert boxes and click save. Gather the post. a Should be similar to this:...
New Relic: CSRF- delete all empty server policy
A CSRF vulnerability is found in the application, using which an attacker can delete all empty server policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...
New Relic: CSRF - Delete all empty application policy
A CSRF vulnerability is found in the application, using which an attacker can delete all empty application policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...
New Relic: No Rate Limitation on Promo Code
Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...
New Relic: Vulnerable Link Leaks the User Names
Hello, Vulnerable Link: https://rpm.newrelic.com/accounts/XXXXXX/setup POC: Login to the Account. Visit the Above Link. Now, Log Out! Visit that Link Again. Here you go!!! "Display Name" is leaking in front, and the "first name" and "last name" is leaking on the right side bar. Thanks! regards,...
New Relic: https://rpm.newrelic.com/login vulnerable to host header attack
It appears that https://rpm.newrelic.com/login is vulnerable to a host header attack flaw whereas the HTTP Host header can be controlled by a malicious user. POC: curl -H "Host: rpm.newrelic.com" -H "X-Forwarded-Host: geeknik.com" https://rpm.newrelic.com/login Result: You are being redirected. A...
New Relic: https://rpm.newrelic.com/.htaccess file is world readable
Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://rpm.newrelic.com/.htaccess to become world readable, as you can see from the information below and th...
New Relic: Server Side Browsing - localhost open port enumeration
Hi again to all, I've found that is possible to scan all the open ports and network information of internal instances of your amazon DC that are related with synthetics monitors. NOTE: I do not have a pro account so I can use the more advanced synthetics functions or the Insights db query to get...
New Relic: Reflected XSS on Signup Page
Hello Team, I have found a reflected XSS on Signup Page i.e. on https://newrelic.com/signup. Please find the below details. Vulnerable URL: https://newrelic.com/signup Vulnerable Field: Your Email Address Vulnerable Parameter: email Parameter Type: POST Payload used: Browser used: Mozilla Firefox...
New Relic: open redirection at login
Hi guys, their is open redirection at login page if the user logged in he will be redirected directly if the user not logged in he will be redirected after the login URL : https://login.newrelic.com/login?returnto=http:example.com to reproduce go to...
New Relic: Potential Subdomain Takeover - http://storefront.newrelic.com/
Hi, The subdomain "storefront.newrelic.com" is currently pointing to Fastly, but is not registered to a service. Depending on whether Fastly permits it, a subdomain takeover similar to that of https://hackerone.com/reports/32825 could be possible. If the subdomain is not needed, it's recommended...
New Relic: [login.newrelic.com] XSS via return_to
The returnto parameter is not validated properly, which allows an attacker to execute javascript via the data: protocol: https://login.newrelic.com/login?returnto=data:text/html%3Bbase64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg%3D%3D Despite being executed not in the newrelic domain, the script still c...