Is CVE-2023-50249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-50249 being exploited in the wild.

How severe is CVE-2023-50249?

Low severity, with a CVSS score of 3.1, published 18 December 2023.

Which products and versions are affected?

@sentry/astro (npm) SEMVER:introduced=7.78.0,fixed=7.87.0; Sentry Astro SDK 7.78.0-7.86.0.

Is there a fix for CVE-2023-50249?

Yes. @sentry/astro (npm): upgrade to 7.87.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-50249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-50249?

Check whether you run @sentry/astro (npm) or Sentry Astro SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-50249: Sentry Astro SDK regular expression denial of service

CVE-2023-50249 · Severity: low · CVSS 3.1 · Published 2023-12-18

Sentry's Astro SDK, used to monitor errors and performance in web applications, contains a regular expression vulnerability that allows attackers to cause excessive server computation and service outages. Applications running affected SDK versions with multi-parameter routes are vulnerable to denial of service attacks without authentication.

Technologies: @sentry/astro (npm). Vendors: npm, Sentry.

Quick answers

Is CVE-2023-50249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-50249 being exploited in the wild.
How severe is CVE-2023-50249?: Low severity, with a CVSS score of 3.1, published 18 December 2023.
Which products and versions are affected?: @sentry/astro (npm) SEMVER:introduced=7.78.0,fixed=7.87.0; Sentry Astro SDK 7.78.0-7.86.0.
Is there a fix for CVE-2023-50249?: Yes. @sentry/astro (npm): upgrade to 7.87.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-50249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-50249?: Check whether you run @sentry/astro (npm) or Sentry Astro SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sentry/astro (npm): upgrade to 7.87.0 or later
```
npm install @sentry/astro@7.87.0
```

Technical details

A regular expression denial of service (ReDoS) vulnerability exists in Sentry's Astro SDK versions 7.78.0 through 7.86.0. The vulnerability is triggered when applications have routes with at least two path parameters (e.g., /foo/[p1]/bar/[p2]) and are using Sentry instrumentation, either through manually registered middleware or automatic server instrumentation in Astro 3.5.0+. An attacker can send specially crafted requests that cause the vulnerable regex pattern to perform excessive backtracking, consuming server resources and causing denial of service. The vulnerability is network-reachable, requires no authentication or user interaction, and has been patched in version 7.87.0.

Affected products

Sentry Astro SDK 7.78.0-7.86.0

Identifiers

CVE-2023-50249
GHSA-x3v3-8xg8-8v72

Timeline

2023-12-18: disclosed
2023-12-18: patched: Fixed in version 7.87.0

References

https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.