CVE-2023-36829: Sentry CORS misconfiguration vulnerability

Vulnerability summary

CVE-2023-36829 is a medium (CVSS 6.8) Incorrect Authorization vulnerability in functional sentry. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.

Timeline

1. 06-07-2023
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
• CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.