New Relic: Cookie Misconfiguration

1 install add ons "Edit this Cookie" in google chrome" 2 login your account/create an account 3 get the cookie using "edit this cookie" 4 logout the account 5 delete the current cookie using edit this cookie and put the cookie what you copy and refresh the tab Video...

New Relic: All Active user sessions should be destroyed when user change his password!

hello security, There is an user sessions issue on your application that should be fixed. Proof of Concept Suppose, you have an account on newrelic.com Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll do ? i...

New Relic: CSRF vulnerability that allows an attacker to purge plugin metric data

Vulnerability details A seemingly minor CSRF vulnerability exists in the endpoint that purges plugin metric data. When an admin visits the Agent overview of its account, it will show a button for each plugin that allows the admin to purge the data. This button links to a GET requests that is...

New Relic: Login CSRF vulnerability

Hi New Relic security team, While doing pentesting on your website, I found that while logging into the account the "authenticitytoken" was not properly validated. I was able to login into my account even without "authenticitytoken". Impact: High Steps to Reproduce: 1 Login to your account. 2 Whi...

New Relic: Leaking license key in source code

Restricted role user has no way to view the license key, but the license key is leaking in the source code. Steps to reproduce Assume userA is owner, userB is restricted user. Login as userB and go to https://rpm.newrelic.com/accounts/accid/applications/setup Select any Web agent, view page sourc...

New Relic: [alerts.newrelic.com] Scanning local network via notification channel

When setting a notification channel an attacker can sumbit a local link as the channel url, which allows him to scan the local network by sending test notifications. PoC: 1. Log into your account 2. Go to the notification channels page https://alerts.newrelic.com/accounts/%USERID%/channels 3...

New Relic: http://newrelic.com SSRF/XSPA

A Server Side Request Forgery / Cross Site Port Attack was discovered via a POST request to http://newrelic.com/syntheticspreviews and using the parameter within the body of the request testurl. A Server Side Request Forgery vulnerability allows to issue remote connections on behalf of the affect...

docs.newrelic.com XSS vulnerability

Vulnerable URL: https://docs.newrelic.com/search/node/a%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Chec...

New Relic: Open redirection bypass .

The following link bypasses the current protection : https://login.newrelic.com/login?returnto=https://rpm.newrelic.com/auth/newrelic?origin=///evil.com After entering the correct credentials , the above link will redirect to evil.com...

New Relic: SSRF on synthetics.newrelic.com permitting access to sensitive data

ylujion reported to us that it was possible to conduct a SSRF attack against Synthetics. This attack could be used to obtain various sensitive data about the server on which the Synthetics monitor is running. The report was particularly clever because access to the IP in question was explicitly...

New Relic: Session takeover

Your website is vulnerable to session takeover Steps to reproduce: 1Log in to the same account in two browsers 2Now change the password of the account in any one browser 3Now go to the other browser and it doesn't ask the user to sign in again Please fix these issues as soon as you can . Awaiting...

New Relic: No CSRF validation on Account Monitors in Synthetics Block

Hello, There is no CSRF token validation on DELETING "monitor" which we create in synthetics section. DELETE /accounts/1338635/monitors/de70ee8d-2fa0-416c-8592-47ebde01aa7e.json HTTP/1.1 Host: synthetics.newrelic.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45...

New Relic: JIRA account misconfig causes internal info leak

This issue was originally reported via email [email protected] Hello, In preparation for security conference I'm doing a research of popular task tracking systems / project management software and how they affect company's IT security. During investigation I've found several critical...

New Relic: Privilege Escalation In Moniter

When one user create an account its data may not be accessible by other user. Links are only opened by a privilege user But What here happens is. I login from one account & copy a link, it will still accessible two other account with help of burp proxy by traffic stopping. Reproduce Steps :- 1...

New Relic: Improper Session Management

When a User successfully login to account there are new 3 links which he/she can visit but when a user Logout from one link ex:- HTTP://insights.newrelic.com/accounts/11 user successfully logout message will appear & logout. Here user will logout from 2 links ex :-...

New Relic: Missing rate limit on password

Hello, in login page https://login.newrelic.com/login there is no rate limit for brute force attack on password which allow attacker to do as much he can from requests for guessing the user password. the same was happened in Facebook newrelck.pngF93837 Thaanks...

New Relic: New Relic - Session Hijacking

Hey, I have found a vulnerability in New Relic, so the bug is called "Session Hijacking". You can see the Proof of Concept video which I've attached to confirm the vulnerability. Steps to Reproduce: 1 Login to your account 2 Copy your cookies 3 Logout 4 Clear browser cookies 5 Paste the cookies...

New Relic: newrelic.com rails directory traversal vuln

details: https://github.com/omarkurt/cve-2014-0130 POC: GET /devops/%5c%2e%2e%2f%5c%2e%2e%2f%5c%2e%2e%2fGemfile HTTP/1.1 Cookie: Host: newrelic.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko...

New Relic: Stored Cross-Site Scripting via Angular Template Injection

It's possible to inject angular expressions into the account settings of a new relic account. This, combined with an angular sandbox escape allows for persistant cross-site scripting which is executed in the browser of any user visiting the affected page. The execution of which could be used to...

New Relic: Open redirection

Hey To reproduce: go to https://login.newrelic.com/login?returnto=http:/example.com https://login.newrelic.com/login?returnto=http:///example.com https://login.newrelic.com/login?returnto=http:////example.com and login you will be redirected to http://example.com...