CVE-2023-31415

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of t...

PT-2023-23308

Name of the Vulnerable Software and Affected Versions Kibana version 8.7.0 Description The issue is an arbitrary code execution flaw. An attacker with all privileges to the Uptime/Synthetics feature could send a request to execute JavaScript code, potentially leading to the execution of arbitrary...

Elastic: Synthetics Recorder: Code injection when recording website with malicious content

A vulnerability was discovered in the Synthetics Recorder tool, which allows attackers to inject arbitrary code into a recording session. The waitForNavigation event calls quote within the context of a multi-line comment, which can be escaped with a specially crafted URL. This can lead to code...

MAL-2022-2641 Malicious code in e2e-synthetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f700f7ce68fda83b5ff3db77adb99de4580261e3922607f1c4210c7d31e9979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in e2e-synthetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f700f7ce68fda83b5ff3db77adb99de4580261e3922607f1c4210c7d31e9979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in datadog-synthetics-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb7d5c2b8247d500672b7c1089217058c98f072aa33d33e0f42bb0711fab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2353 Malicious code in datadog-synthetics-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb7d5c2b8247d500672b7c1089217058c98f072aa33d33e0f42bb0711fab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Relic: Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabled

Introduction & Context This is a complex XSS that requires multiple steps in order to setup. It also requires you to have a good understanding of both New Relic Insights, New Relic Synthetics monitors, and the NerdGraph API explorer. Background Context: New Relic Synthetics and the history of tag...

New Relic: Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

@skavans identified an endpoint for testing Synthetics monitors. Without proper validation, this could allow monitors from other accounts to run on your account with knowledge of the monitor's ID: POST /accounts//monitors/monitor/recheck.json?monitorId= HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

New Relic: User can run monitors at private locations, which he has no access to

@skavans discovered that insufficient validation was performed when configuring Synthetics monitors allowing deployment to arbitrary private locations with knowledge of the location ID: POST /accounts//validation.json HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Stored XSS at Synthetics private locations (planted through location label or description)

Hey team, I've discovered stored XSS at Synthetics private locations list. The Private locations page contains a script with private locations metadata inside and the user-input of location label and description aren't properly escaped as you can see below: html window.nr =...

New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...

New Relic: NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

@jonbottarini identified an issue where our permissions for Synthetics didn't match the permissions elsewhere in our product. This eventually led to a change in our underlying permissions code to unify our products and prevent issues like this...

New Relic: [NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions

This bug requires a bunch of pre-setup, and a few conditions to make it work, but I'll do my best to write it out without making this a novel. You will need: 1. Account that is an admin 2. Account that is a "Restricted" user, without any synthetics permissions so, can't view monitors, can't edit...

New Relic: [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sending

While setting up a Synthetics "Ping", I noticed that the name of your monitor was echoed back in warning emails about hosts that fail the validation string phase. I abused this mechanism to insert newline mechanism in these emails, allowing the sending of near arbitrary emails to a easily...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...

New Relic: [NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}

This report is two reports in one, but I figured why create two reports when the root cause is essentially the same exact endpoint. Description When a restricted user with no permissions to view synthetics monitors tries to navigate to the permissions settings within Synthetics...

New Relic: [NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

Hey all, This one is pretty interesting. What's happening is that a user with no permissions to view synthetics will get this page when they try to navigate directly to the Synthetics monitor list https://synthetics.newrelic.com/accounts/1523936/monitors: F267305 However, the restricted user can...