CVE-2023-46729: Sentry Next.js SSRF in SDK tunnel endpoint

CVE-2023-46729 · Severity: low · CVSS 3.1 · Published 2023-11-09

A vulnerability in the Sentry SDK for Next.js applications could allow attackers to trick the server into making unauthorized web requests. This component is typically used to bypass ad-blockers so that error reports can reach Sentry's monitoring service. If exploited, an attacker could potentially access internal network services, steal sensitive cloud metadata, or perform malicious actions on behalf of the server, leading to data exposure or further compromise of the infrastructure.

Technologies: @sentry/nextjs (npm), Sentry Next.js SDK. Vendors: npm, Sentry.

Quick answers

Is CVE-2023-46729 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-46729 being exploited in the wild.
How severe is CVE-2023-46729?
Low severity, with a CVSS score of 3.1, published 9 November 2023.
Which products and versions are affected?
@sentry/nextjs (npm) SEMVER:introduced=7.26.0,fixed=7.77.0; Sentry Next.js SDK >= 7.26.0, < 7.77.0.
Is there a fix for CVE-2023-46729?
Yes. @sentry/nextjs (npm): upgrade to 7.77.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-46729 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-46729?
Check whether you run @sentry/nextjs (npm) or Sentry Next.js SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sentry/nextjs (npm): upgrade to 7.77.0 or later
    npm install @sentry/nextjs@7.77.0

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the @sentry/nextjs SDK due to unsanitized input handling in the tunneling endpoint. When the 'tunnelRoute' option is enabled, the SDK uses Next.js rewrites to forward envelopes to Sentry. However, the 'o' (orgId) and 'p' (projectId) query parameters were not strictly validated, allowing an attacker to inject characters like slashes to manipulate the destination URL. This enables an attacker to send HTTP requests to arbitrary internal or external URLs and reflect the responses back to the user. The vulnerability can be used for internal port scanning, accessing cloud metadata services (IMDS), or facilitating XSS/CSRF attacks. The fix in version 7.77.0 introduces strict regex validation for these parameters.

Affected products

  • Sentry @sentry/nextjs >= 7.26.0, < 7.77.0

Identifiers

  • CVE-2023-46729
  • GHSA-2rmr-xw8m-22q9

Timeline

  • 2023-10-30: other: Vulnerability reported to Sentry via bug bounty program
  • 2023-10-31: patched: Fix merged and version 7.77.0 released
  • 2023-11-01: other: Vercel implemented infrastructure-level mitigation for hosted apps
  • 2023-11-09: advisory: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.