CVE-2024-24829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-24829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-24829
Aliases
  • GHSA-rqxh-fp9p-p98r
Published
2024-02-08T23:44:07.676Z
Modified
2026-08-12T03:51:37.268890547Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
SSRF in Sentry via Phabricator integration
Details

Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24829.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/getsentry/self-hosted

Affected ranges

Type
GIT
Repo
https://github.com/getsentry/self-hosted
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c63e838a211233e196eac9cb2effc7e7d6603587
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "24.1.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/getsentry/sentry
Events
Introduced
236d4b88f1fc98fcedd7800c65d798504c186bc2
Fixed
ff4c7ec45fee6edf119139a8ec8d05048a05b9a5
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "24.1.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24829.json"