New Relic: [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sending

While setting up a Synthetics "Ping", I noticed that the name of your monitor was echoed back in warning emails about hosts that fail the validation string phase. I abused this mechanism to insert newline mechanism in these emails, allowing the sending of near arbitrary emails to a easily...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...

New Relic: [NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}

This report is two reports in one, but I figured why create two reports when the root cause is essentially the same exact endpoint. Description When a restricted user with no permissions to view synthetics monitors tries to navigate to the permissions settings within Synthetics...

New Relic: [NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

Hey all, This one is pretty interesting. What's happening is that a user with no permissions to view synthetics will get this page when they try to navigate directly to the Synthetics monitor list https://synthetics.newrelic.com/accounts/1523936/monitors: F267305 However, the restricted user can...

New Relic: [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

Did you think I had fallen of the earth? Fear not - for I have returned. In 255894 you fixed the issue where a person could mass-harvest names of other New Relic users through the user management section. A fix was quickly pushed for this, but now I've found a workaround. I'm reporting this on th...

New Relic: Restricted User is able to edit Alert Conditions of Synthetics Monitors even if Synthetics Permissions is enabled by an admin

In this vulnerability, a restricted user is able to edit the alert conditions of a synthetics monitor, even if he is unauthorized to do so. Steps to reproduce: - Admin user invites User1 to New Relic account as a restricted user - User1 accepts invitation, joins the account - Admin goes to...

New Relic: SSRF on synthetics.newrelic.com permitting access to sensitive data

ylujion reported to us that it was possible to conduct a SSRF attack against Synthetics. This attack could be used to obtain various sensitive data about the server on which the Synthetics monitor is running. The report was particularly clever because access to the IP in question was explicitly...

New Relic: No CSRF validation on Account Monitors in Synthetics Block

Hello, There is no CSRF token validation on DELETING "monitor" which we create in synthetics section. DELETE /accounts/1338635/monitors/de70ee8d-2fa0-416c-8592-47ebde01aa7e.json HTTP/1.1 Host: synthetics.newrelic.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45...

New Relic: Synthetics Xss

Hello New Relic Team , i have just found that i can add html code and it will be executed . the issue in https://synthetics.newrelic.com if you added a new monitor with the html code , for example " when you go to https://synthetics.newrelic.com/accounts/"accountnumber"/synthetics and search for ...