CVE-2023-36829 Sentry CORS misconfiguration vulnerability
Sentry API misconfiguration allows credential leakage via CORS if base hostname is set, enabling potential multi-step attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-36829?
CVE-2023-36829 is a medium-severity vulnerability in getsentry sentry, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
Which versions are affected by CVE-2023-36829?
3 open source packages ship an affected version, including sentry. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sentry PyPI | From 23.6.0 | 23.6.2 |
sentry PyPI | From 23.6.0 | 23.6.2 |
sentry PyPI | From 23.6.0 | 23.6.2 |
Products include Functional Sentry.
How do I fix CVE-2023-36829?
Upgrade sentry to 23.6.2 or later.
Is CVE-2023-36829 being exploited?
There is no known exploitation of CVE-2023-36829 in the wild and no public exploit code.
Sources
Also known as GHSA-4xqm-4p72-87h6, PYSEC-2023-115.