New Relic: Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

Hey team, I've discovered an improper user-input filtration issue at charts embedding herald.service.newrelic.com leading to both cross-account stored XSS and SSRF. There is an action Get chart link for some charts for instance, for the ones located at Mobile - Overview. F600887 After user clicks...

New Relic: Stored XSS at Mobile (Versions tab)

Hey team, I've discovered stored XSS rendered at Mobile inside the Versions tab working at least at latest Safari and latest Chrome MacOS. Steps to reproduce: 1 Sign into Mobile with some account which can edit the mobile applications 2 Navigate to some active mobile app, then go to Settings -...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

New Relic: Can fake content email of newrelic to any user

@lamscun reported an issue where an arbitrary account name, including special characters and anchor tags, would show up in an invitation email. While we've seen this issue several times, we've decided not to change how account names are formatted. Ultimately, the email client determines how the...

New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

New Relic: User can run monitors at private locations, which he has no access to

@skavans discovered that insufficient validation was performed when configuring Synthetics monitors allowing deployment to arbitrary private locations with knowledge of the location ID: POST /accounts//validation.json HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Stored XSS at APM transaction map (transactionName field)

Hey team, You've recently fixed my previous report about transaction map stored XSS 549084 and the fix is correct, I wasn't successful with finding a bypass. But I've discovered another vulnerable transaction map field transactionName. An attacker can inject a payload inside this field and then,...

New Relic: Restricted user can add and delete tags of APM key transactions

Description Within APM after you setup a connection, there is the ability for you to mark a "key transaction" which will then populate data on the Key Transactions page in APM. On this page, there is the ability for an admin to hover over the tag icon and add a tag to the name of the key...

New Relic: Stored XSS Via NRQL chartbuilder JSON view

I've found another stored XSS that can affect other users through the JSON chart type in one.newrelic.com Steps to Reproduce: 2. Navigate to the chart builder in one.newrelic.com 3. Within the chart builder, perform the following NRQL query: SELECT “ "' Style=position FROM SyntheticCheck 4. Paylo...

New Relic: CSTI fix (#587829) bypass leading to stored XSS at plugins again

@skavans discovered a workaround for previous XSS mitigations. This led to a more robust approach to filtering dangerous content in Angular templates...

New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder

This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...

New Relic: Site-wide clickjacking at IE11

Hey team, I have discovered that the protection you use for clickjacking preventing is a CSP with frame-ancestors directive. But IE11 doesn't support this directive so you customers using this browser can be attacked. The market share of IE11 is about 2.5% now and it's higher than, for example,...

New Relic: Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin

Hey team, I have discovered a stored XSS vulnerability at infrastructure alerts runbook URL. There is a filter that is not allowed this URL to be with javascript: scheme, but I have found a way to bypass it. Alerts can't be created/modified by users with role lower than "admin" so I will show you...

New Relic: Urgent! Stored XSS at plugin's violations leading to account takeover

Hey team, I have found a stored XSS which is fired at plugin's Violations page. This vulnerability can be used by malicious plugin maker to take over any account which installs this malicious plugin. Vulnerability details The Violations page contain the following script inside its source code: ht...

New Relic: CSTI at Plugin page leading to active stored XSS (Publisher name)

Hey team, I have discovered the CSTI vulnerability at NR single Plugin page leading to stored XSS. To plant the payload you need to publish new plugin using account having the payload inside its name. Below I show you the easiest way to reproduce this using a python script which creates the new...

New Relic: Stored XSS at APM key transactions list

Hey team, I have discovered an XSS firing at APM key transactions list. Steps to reproduce 1 Sign into the APM with some account with some account which can change the APM application name 2 Navigate to some app, which has tracked key transactions, or switch on tracking of some its transaction by...

New Relic: Stored XSS firing at the "Add chart to note" popup

Hey team, I have long found that a request retrieving content for Add chart to note popup is XSS-vulnerable. The following Add to note popup F484252 retrieves its content via the following request: http GET...

New Relic: Stored XSS firing at transaction map (applicationName field)

Hey team, I have discovered the stored XSS vulnerability which is triggered at transaction map. The transaction map is retrieved via GET-request to the URL like https://rpm.newrelic.com/accounts/2319495/applications/143826822/transactions/2877762416/transactionmap. The response contains the...

New Relic: Stored XSS at APM apps labels autocomplete dropdown (apps listing)

Hey team, I have discovered the stored XSS vulnerability triggered at APM apps labels autocomplete dropdown. Only admins are able to add labels to apps, so it seemed to me that this XSS impact is "admin to owner" only. But I googled a little and stumbled upon the NEWRELICLABELS environment variab...

New Relic: Stored XSS at APM applications listing

Hello team, I have discovered that the attacker which can create APM app or modify the existing app name can cause a stored XSS firing at APM apps listing page. There is a script like the following at the APM apps listing page: javascript window.applicationData =...