Is CVE-2024-53253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-53253 being exploited in the wild.

How severe is CVE-2024-53253?

Medium severity, with a CVSS score of 5.3, published 22 November 2024.

Which products and versions are affected?

sentry (PyPI) ECOSYSTEM:introduced=0,last_affected=24.11.0, ECOSYSTEM:introduced=24.11.0,fixed=24.11.1.

Is there a fix for CVE-2024-53253?

Yes. sentry (PyPI): upgrade to 24.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-53253 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-53253?

Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-53253: Sentry information disclosure in Search UI component error handling

CVE-2024-53253 · Severity: medium · CVSS 5.3 · Published 2024-11-22

Sentry, an application monitoring platform, was found to leak sensitive integration credentials in certain error messages. When a user interacts with specific search components that fail to validate third-party responses, the system may return the integration's Client ID and Client Secret in plaintext within the HTTP response. While these credentials alone do not grant full access to data, they could be used by an attacker who has also obtained a valid API token to compromise application integrations.

Technologies: sentry (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-53253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-53253 being exploited in the wild.
How severe is CVE-2024-53253?: Medium severity, with a CVSS score of 5.3, published 22 November 2024.
Which products and versions are affected?: sentry (PyPI) ECOSYSTEM:introduced=0,last_affected=24.11.0, ECOSYSTEM:introduced=24.11.0,fixed=24.11.1.
Is there a fix for CVE-2024-53253?: Yes. sentry (PyPI): upgrade to 24.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-53253 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-53253?: Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sentry (PyPI): upgrade to 24.11.1 or later
```
pip install "sentry>=24.11.1"
```

Technical details

An information disclosure vulnerability exists in Sentry due to improper error handling in the 'select-requester' component. When a Search UI component with the 'async' flag enabled receives an invalid response from a third-party service, Sentry returns a 'select-requester.invalid-response' error. This error message includes a serialized version of the Sentry application, which contains the plaintext Client ID and Client Secret. The vulnerability is rooted in 'src/sentry/sentry_apps/external_requests/select_requester.py'. Attackers can observe these secrets in the underlying HTTP response, though they are not rendered in the UI. A fix is available in version 24.11.1.

Affected products

Sentry Sentry 24.11.0

Identifiers

CVE-2024-53253
GHSA-v5h2-q2w4-gpcx
PYSEC-2024-310

Timeline

2024-11-22: advisory: GHSA-v5h2-q2w4-gpcx published
2024-11-22: patched: Sentry version 24.11.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.