CVE-2023-39349: Sentry vulnerable to privilege escalation via ApiTokensEndpoint

Vulnerability summary

CVE-2023-39349 is a high (CVSS 8.1) Improper Access Control vulnerability in getsentry sentry. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 64.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-08-2023
   PublishedVulnerability first disclosed.
2. 04-10-2024
   Last modifiedVulnerability information updated.

Description

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.