Executive brief
Sentry is an application monitoring and error tracking platform used by developers to identify and fix software bugs. A security vulnerability in version 8.2.0 allows an administrative user to take full control of the server by uploading malicious data through the audit log system. This could lead to a complete compromise of the application, unauthorized access to sensitive error logs, or disruption of monitoring services.
Technical details
A remote code execution (RCE) vulnerability exists in Sentry 8.2.0 due to insecure deserialization of Python 'pickle' objects. The vulnerability is located in the admin audit log endpoint, specifically within the 'data' parameter of the audit log entry. An attacker with superuser privileges can submit a POST request to '/admin/sentry/auditlogentry/add/' containing a base64-encoded, compressed pickle payload. When the application attempts to process this data, it deserializes the object, leading to arbitrary command execution with the privileges of the application process. While the exploit requires authentication, the impact is a total compromise of the host. Fixed versions are reported to be 8.1.4 and 8.2.2.
Affected products
- Sentry Sentry 8.2.0
Timeline
- 2021-09-22: disclosed: Exploit code published on Exploit-DB
- 2026-05-10: advisory: NVD and VulnCheck advisory published