New Relic: Missing Authorization check on View permissions for Alerting Conditions via /internal_api/1/accounts/XXXXXXX/policies/YYYYYYY/conditions?offs endpoint

@archangel reported that an elevation-of-privilege due to a missing authorization check on View permissions for Alerting Conditions could have allowed a user to see alerting policies without having the rights to do so...

New Relic: Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on host

Hi team, The New Relic Java agent is using SnakeYAML for deserialization of the newrelic.yml config file. SnakeYAML has a 'feature' which can lead to code execution, this is documented here. With the !!com.some.Class "arg1", "arg2" notation it's possible to call Java code during the deserializati...

New Relic: Account Takeover via Email ID Change and Forgot Password Functionality

@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...

CVE-2020-36189

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

UBUNTU-CVE-2020-36189

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

New Relic: Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabled

Introduction & Context This is a complex XSS that requires multiple steps in order to setup. It also requires you to have a good understanding of both New Relic Insights, New Relic Synthetics monitors, and the NerdGraph API explorer. Background Context: New Relic Synthetics and the history of tag...

New Relic: Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.com

@ashmek identified an inconsistency with account mapping between New Relic One and the discussion forum. This resulted in a situation where a user who has changed their email address could have contents of their account displayed to a new user who had access to the original email address...

New Relic: removed user can still join the organization

hi, i would like to report an issue i have found that allow attacker to join organization even if the attacker is removed. i found out that when adding new user, if you add a new user without verifying the email address, you change the email of the user, the email address you initially send the...

New Relic: IDOR - User is able to download charts/dashboards from cross accounts

@k3ne described an issue where a user on an account could access data concerning dashboards for another user on the same account. While this appeared to be a cross-account access issue, both users on the account have access to the same data by design...

New Relic: "Basic user" which can only access a limited subset of the platform can access certain pages which are restricted to the user by the account owner.

@jhimansh described an issue where forced browsing could be used to visit restricted pages as an unprivileged user. As our web application is shipped as client side JavaScript, there is no way to prevent viewing all pages within that code. However, checks are done server-side to ensure that...

New Relic: Adding your account to victim's app via deeplink

At your android app, there is a feature for passwordless login. It sends an email and if you click the link, it triggers a deeplink on the app for login. I think this feature needs a state control, for example setting loginstatetoken=ABC on the requester device and adding this loginstatetoken to...

New Relic: Sending thousands of notifications with single request

Hello, while testing your mobile api an endpoint got my attention. This endpoint was: https://api.newrelic.com/api/ios/v3/devices/update.json?operation=register I immediately checked if server is validating the integrity of data or not. After finding out there is no validation, I added around 500...

New Relic: HTML injection at Alert email

@wi11 discovered an issue with Alerts notification emails where supplied HTML tags would be rendered by the email generator. This could allow an attacker to embed arbitrary hyperlinks or images under the header in those Alerts emails. Some prople asked me about this bug, so I give a simple...

New Relic: One Click Remote Code Injection - *.blog.newrelic.com

With some social engineering, a WordPress admin could be convinced to click a malicious link to abuse a vulnerability in a WordPress plugin. This could lead to script execution or even code execution on the host. Vulnerability: A CSRF vulnerability has been found inside the Admin Panel leading to...

New Relic: CRLF Injection in email address

The researcher discovered an issue where control characters can be used when intercepting a request to update an email address. This would result in an inaccessible account without intervention by our Support team. As denial-of-service is out of scope for our program, and since it is scoped to a...

New Relic: Bypassing Protection Mechanism: Change of Account Name after Session Log out

The researcher illustrated a delay in session invalidation. This has not been added to our public policy to help prevent confusion...

New Relic: Secure credentials values disclosure to regular users due to access control issue in monitor creating function

@skavans discovered a test endpoint for Syntethics monitors that did not properly validate the permissions of the user making the request. This could allow lesser privileged users on the same to account create monitors using Secure Credentials...

New Relic: Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

@skavans identified an endpoint for testing Synthetics monitors. Without proper validation, this could allow monitors from other accounts to run on your account with knowledge of the monitor's ID: POST /accounts//monitors/monitor/recheck.json?monitorId= HTTP/1.1 Host: synthetics.newrelic.com...

New Relic: Attacker can create new account inside any partnership with no approve from the Partnership owner

@skavans discovered a way to link an account with an arbitrary Partnership with a known ID. Validation was added to prevent linking to unintended partnerships...

New Relic: Ability to buy PRO subscriptions by arbitrary reduced prices

Hey team, I've found that a malicious user can buy PRO subscriptions by arbitrarily reduced prices. Steps to reproduce 0 Make sure you have an account without subscriptions at APM PRO bought. If you don't – register a new one. It works for me inside the EU accounts at least. 1 Sign in this accoun...