New Relic: Upgrade menu exposes the mobile application token meant to only be visible to administrators

Usually, the restricted user is not able to view the mobile application token for a mobile app - the page that this token is visible on is only accessible to administrators. However - there exists a workaround to this if you are a restricted user and you still want to obtain this token - simply...

try.newrelic.com XSS vulnerability

Open Bug Bounty ID: OBB-695965 Description| Value ---|--- Affected Website:| try.newrelic.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

New Relic: Swiftype key stored in JavaScript source

Hi, I am surfing on the newrelic website. I found a sensitive data including authentication key written in public accessible javascript file. Some 3rd party solution SwiftType newrelic using for crawling or search/suggestion. below is the link where you can find the authkey. which would be able t...

New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...

New Relic: WordPress username enumeration (/author)

@rootbakar identified a previously-reported issue where authors could be viewed from an endpoint within our WordPress blog. As authors are intended to be public, this was closed as not having any security impact to the blog...

New Relic: [NR Infrastructure] Restricted user can update integration provider account name via integrations API

NR Infra allows you to create a GCP integration and set a custom name. By default, the restricted user account can't change anything associated associated with this type of infra integration, but there is a missing check on changing the name of the integration through the integrations API. Observ...

New Relic: [NR Insights] Pull any Insights/NRQL data from any NR account

@jonbottarini discovered an issue where a feature within a cloud integration wasn't properly validating account IDs. This report helped us identify a backend issue that could prevent account validation from taking place in certain situations. This was a fun one! The full writeup is for this bug i...

New Relic: DNS misconfiguration on email.alerts.newrelic.com

While checking the subdomains i found that the subdomain email.alerts.newrelic.com upon navigating downloads a file saying "Mailgun Magnificent API" And has the following DNS info screenshot attached The problem lies in this issue: You add the domain email.alerts.newrelic.com to Mailgun Mailgun...

New Relic: [NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app

In NR Insights, there is the ability to set a permissions for the data app itself. It's located here: F326634 Now, in this section, if a user creates a new data app and sets the permissions to "visible to others within my account" it essentially provides read-only access to the data app and its...

New Relic: NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

@jonbottarini identified an issue where our permissions for Synthetics didn't match the permissions elsewhere in our product. This eventually led to a change in our underlying permissions code to unify our products and prevent issues like this...

New Relic: [NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions

This bug requires a bunch of pre-setup, and a few conditions to make it work, but I'll do my best to write it out without making this a novel. You will need: 1. Account that is an admin 2. Account that is a "Restricted" user, without any synthetics permissions so, can't view monitors, can't edit...

New Relic: Restricted user can bypass permissions restriction to create NR Alert policies

So this one is similar to my other privilege escalation issues, but it comes with a sidenote which may lead to some more interesting issues if you feel like digging into it. Issue: User with read only privileges can create NR Alert policies through POST request to Infrastructure-Data service...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

New Relic: IDOR via internal_api "users" endpoint

While trying to figure out what the heck is going on with 347664, I stumbled upon another way to perform the "gift that keeps on giving" as @ahamlin put it. Steps to reproduce: 1. Add a unconfirmed user to your account 2. Navigate to https://alerts.newrelic.com/accounts/1523936/channels 3. Click ...

New Relic: Stored XSS in Brower `name` field reflected in two pages

The Name field of the Brower apps feature is not properly escaped in at least two pages. An attacker can create a new browser application with a specially crafted Name field which will be reflected and interpreted by other users visiting these two pages. Leveraging this vulnerability, I was able ...

New Relic: Permissions leaks the full name of other NR accounts - Regression of #267636

One more before I run to dinner... Steps to Reproduce: 1. Add a user to your account 1. Enter "123" as the name and "[email protected]" as the email 1. Make them a "user" base role. 1. Click add user button. 2. Navigate to https://synthetics.newrelic.com/accounts/1523936/permissions 3. Create a...

New Relic: [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sending

While setting up a Synthetics "Ping", I noticed that the name of your monitor was echoed back in warning emails about hosts that fail the validation string phase. I abused this mechanism to insert newline mechanism in these emails, allowing the sending of near arbitrary emails to a easily...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

New Relic: Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels page

The NR developers did a really good job at restricting me from finding out info about other user accounts through the NR Synthetics settings - so far I haven't found a way to bypass it yet 😉. There exists another way to obtain this information about other user accounts, and it has to do with the...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...