New Relic: Internal API endpoint discloses full account name of email address associated with unconfirmed user

There's an interesting thing happening with the Internal API call that lists users on an account. Based on what I can tell, it's another IDOR like █████████ in which it exposes user information of accounts that Steps to reproduce: 1. Create an account 2. As an admin, go to create a new user...

New Relic: Drupal admin takeover via install.php not being performed prior to install.

@grampae discovered an uninitialized Drupal instance running on one of our properties being hosted by a third party provider, an issue we've seen previously. To prevent this issue from surfacing again, we decommissioned the related domains and contacted the provider with details of the issue...

New Relic: [NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

Hey all, This one is pretty interesting. What's happening is that a user with no permissions to view synthetics will get this page when they try to navigate directly to the Synthetics monitor list https://synthetics.newrelic.com/accounts/1523936/monitors: F267305 However, the restricted user can...

New Relic: Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered a regression in the way users are shown within the Alerts notification UI. This allowed him to reveal the first and last name of an existing registered user if their email was known, rather than showing an obfuscated version of that information. The application protects...

New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions

Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...

GHSA-Q6CW-2553-7837 newrelic_rpm Gem Discloses Sensitive Information

Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information database credentials and SQL statements by sniffing the network and deserializing the data...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

New Relic: Newrelic s3 bucket is writeable and deleteable by authorized AWS users

@kunalbahl discovered an open S3 bucket that appeared to belong to us. It was determined that this belonged to another company and this information was forwarded to Amazon for remediation...

New Relic: [NR Infrastructure] Bypass of #200576 through GraphQL query abuse - allows restricted user access to root account license key

@jonbottarini discovered an issue with our GraphQL implementation. This allowed a user without the proper authorization access to privileged account information on the same account. The writeup for this issue can read here: https://labs.detectify.com/2018/03/14/graphql-abuse/...

New Relic: Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered an issue where names associated with arbitrary existing email addresses can be revealed in the Alerts Notification Channel UI. As with similar previously-reported issues, this was resolved by obfuscating that information before it's presented...

New Relic: NR Internal_API call allows me to read the events/violations/policies/messages of ANY New Relic account (AND pull data from infrastructure)

@jonbottarini identified an issue with an API used to populate the UI across different products. This API wasn't properly validating the account ID for certain requests, returning information for any ID presented. I wrote up a quick overview about this issue here:...

New Relic .NET Agent SQL Injection Vulnerability

New Relic .NET Agent is a . A SQL injection vulnerability exists in New Relic .NET Agent versions prior to 6.3.123.0. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

New Relic: [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

Did you think I had fallen of the earth? Fear not - for I have returned. In 255894 you fixed the issue where a person could mass-harvest names of other New Relic users through the user management section. A fix was quickly pushed for this, but now I've found a workaround. I'm reporting this on th...

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

Sql injection

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

CVE-2017-9246

CVE-2017-9246 affects New Relic .NET Agent (pre-6.3.123.0). The vulnerability arises from failure to escape quotes in Slow Queries, enabling SQL injection via an INSERT VALUES clause after bypassing a SET SHOWPLAN_ALL ON protection. Impact is high/critical per cited metrics, including HIGH confid...

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

New Relic: CSRF For Adding Users

Issue The API affected is https://rpm.newrelic.com/accounts/accountid/accountviews. Only admin users are allowed to add other new users, but a normal user with knowledge of the accountid can craft a webpage which does a CSRF when an admin user visits it. There are 2 problems with it that can resu...

New Relic: /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email"

Hello Team, Vulnerable Url: https://rpm.newrelic.com/accounts/USERID.json Description of the Bug: As Restricted user for an organization cannot Add New users to the Organization, cannot change Organization Name, cannot generate or download report as well as cannot read the information of Owner...