Executive brief
Sentry's Astro SDK, used to monitor errors and performance in web applications, contains a regular expression vulnerability that allows attackers to cause excessive server computation and service outages. Applications running affected SDK versions with multi-parameter routes are vulnerable to denial of service attacks without authentication.
Technical details
A regular expression denial of service (ReDoS) vulnerability exists in Sentry's Astro SDK versions 7.78.0 through 7.86.0. The vulnerability is triggered when applications have routes with at least two path parameters (e.g., /foo/[p1]/bar/[p2]) and are using Sentry instrumentation, either through manually registered middleware or automatic server instrumentation in Astro 3.5.0+. An attacker can send specially crafted requests that cause the vulnerable regex pattern to perform excessive backtracking, consuming server resources and causing denial of service. The vulnerability is network-reachable, requires no authentication or user interaction, and has been patched in version 7.87.0.
Affected products
- Sentry Astro SDK 7.78.0-7.86.0
Timeline
- 2023-12-18: disclosed
- 2023-12-18: patched: Fixed in version 7.87.0