CVE-2024-24829 SSRF in Sentry via Phabricator integration
An attacker with Sentry access can trigger SSRF via Phabricator integration to scan internal networks and interact with internal services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24829?
CVE-2024-24829 is a medium-severity server-side request forgery vulnerability in getsentry sentry, published on 8 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2024-24829?
It affects 1 product.
Products include Sentry Sentry.
How do I fix CVE-2024-24829?
No fix has been published for CVE-2024-24829 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-24829 being exploited?
There is no known exploitation of CVE-2024-24829 in the wild and no public exploit code.
Other vulnerabilities in getsentry sentry
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
- CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
- CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads
Sources
Also known as GHSA-rqxh-fp9p-p98r.