New Relic: Login Open Redirect

The user is not authorized: 1. Go to the login page https://login.newrelic.com/login?returnto=//////////////////////hackerone.com 2. Auth 3. Redirect to hackerone.com did not happen - all is well The user is authorized: 1. Again go to the login page...

New Relic: Sensitive information contained with New Relic APM iOS application

An issue was reported to us against the New Relic APM iOS app. Specifically, the issue was that the release version of the application contained some sensitive information, including internal email addresses and API keys. Versions newer then 3.20.3 released Aug 28, 2015 no longer contain this...

New Relic: APT repository is signed using weak digest (SHA-1)

When installing New Relic on a new Ubuntu 16.04 xenial machine to test out the beta, I noticed this warning: W: gpgv:/var/lib/apt/lists/apt.newrelic.comdebiandistsnewrelicRelease.gpg: The repository is insufficiently signed by key B60A3EC9BC013B9C23790EC8B31B29E5548C16BF weak digest This...

New Relic: Clickjacking on authenticated pages which is inscope for New Relic

Steps to reproduce: 1.Open newrelic sitehttps://newrelic.com/signup 2.Put the signup page in clickjacking code iframe width: 800px; height: 500px; position: absolute; top: 0; left: 0; filter: alphaopacity=50; opacity: 0.5; 3.Observe that site is accesible from the iframe through which an attacker...

New Relic: Password disclosure during signup process

New relic provides user's the option to register new accounts. It was observed that during creation of new account process, user's password is displayed in clear text in response. This leads to disclosure of passwords. There may be another issue here that user's passwords are not stored in hashed...

New Relic: Open redirection bypass

Hello, 123172 is fixed even i found another bypass of open redirection protection at this endpoint. First get logged in and then open following URL : https://login.newrelic.com/login?returnto=///attacker.com You will be redirected on http://attacker.com Bes regards, Shailesh...

Lara Croft: Relic Run - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Lara Croft: Relic Run published at the 'play' market has multiple vulnerabilities...

New Relic: rpm.newrelic.com - monitor creation to other accounts

It is possible to create monitors for other users by changing the user id in the body of the post request when creating a new monitor. Even though my tests were unsuccessful in a XSS on the monitor information, it may be an attack vector to other vulnerabilities since the monitor information show...

New Relic: CSV Injection in sub_accounts.csv

As an admin of a company, I can set my company name to be something like "=1+1", which, when downloaded by me or anyone else with permission to access that file, will execute and show "2" in the excel file. While this may seem safe, I am able to make the name something more malicious, such as...

New Relic: Stored XSS through Angular Expression Sandbox Escape

As an Admin of an account, I am able to set the Name of the Account to an Angular expression. This Angular expressions is resolved and executed on the Insights Welcome Page for anyone that is apart of the Account. Due to the ability to invite anyone even current NewRelic users to an Account, it...

New Relic: Synthetics Xss

Hello New Relic Team , i have just found that i can add html code and it will be executed . the issue in https://synthetics.newrelic.com if you added a new monitor with the html code , for example " when you go to https://synthetics.newrelic.com/accounts/"accountnumber"/synthetics and search for ...

New Relic: Host Header Injection / Cache Poisoning

The application reflects HTTP Header value back in it's response and it may be possible to poison the server cache. The X-Forwarded-Host is directly reflected as a hyperlink. HTTP Request GET / HTTP/1.1 Host: newrelic.com X-Forwarded-Host: pavanw3b.com ... .... HTTP Response HTTP/1.1 200 OK...

New Relic: Normal user can set "Job title" of other users by Direct Object Reference

A normal user when logs in to "New Relic" and navigates to the "Account Settings" page, can only set his/her own Job title. All other user's Job title selection are not available. But using a proxy tool like Burp Suite, while changing his own job role, if he replaces his own ID with any other use...

New Relic: All the active session should destroy when user change his password

hello security, There is an user sessions issue on your application that should be fixed. Proof of Concept Suppose, you have an account on newrelic.com Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll do ? i...

New Relic: Open redirection on login

Hello, Domain : login.newrelic.com Endpoint : https://login.newrelic.com/login?returnto=URL Description : There is a protection against open redirection at this endpoint, so an attacker can't redirect an user to any external website using following :...

New Relic: no email confirmation on signup

the email confirmation is not taken anyone can make newrelic account from any email address...

New Relic: Emails and alert policies can be altered by malicious users.

Recreate Steps 1 Create Two Accounts 2 In separate browsers Firefox and Chrome log into each account and go to the edit page a https://rpm.newrelic.com/users//edit 3 Check one of the email or alert boxes and click save. Gather the post. a Should be similar to this:...

New Relic: CSRF- delete all empty server policy

A CSRF vulnerability is found in the application, using which an attacker can delete all empty server policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...

New Relic: CSRF - Delete all empty application policy

A CSRF vulnerability is found in the application, using which an attacker can delete all empty application policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...

New Relic: No Rate Limitation on Promo Code

Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...