Junglewise Threat Intelligence

Sentry SDK prototype pollution gadget in JavaScript SDKs

Severity: low · CVSS 3.1 · Published 2024-10-03

Vendors: Sentry.

Executive brief

Sentry's JavaScript SDKs could potentially be misused as a gadget to exploit prototype pollution vulnerabilities that exist in a user's application or its dependencies. This does not indicate a flaw in Sentry itself, but rather means that if an attacker has already found a way to pollute the JavaScript object prototype through another vulnerability, they could leverage Sentry's code to achieve greater impact. Users should prioritize fixing any prototype pollution issues in their own applications first.

Technical details

The Sentry JavaScript SDKs contained a prototype pollution gadget due to improper handling of the `wrap()` function in the browser SDK. The vulnerable code could allow a non-function value to be assigned to the `__sentry_wrapped__` property, which subsequent code expected to be a function, leading to potential crashes or exploitation chains. The root cause was insufficient type validation when wrapping functions. An attacker exploiting an existing prototype pollution vulnerability in the application could leverage this gadget to escalate their attack. The vulnerability requires a pre-existing prototype pollution flaw in the user's application or dependencies to be exploitable. The fix, implemented in versions 8.33.0 and 7.119.1, ensures that the `wrap()` function only returns function types, preventing the gadget from being misused.

Affected products

  • Sentry @sentry/browser <7.119.1, >=8.0.0-alpha.1 <8.33.0

Timeline

  • 2024-10-03: disclosed
  • 2024-10-02: patched: Version 8.33.0 released
  • 2024-10-04: patched: Version 7.119.1 backport released

References