Listen to this Post
When the `sendDefaultPii` configuration option is set to `true` in affected versions of the Sentry Node.js SDK, the SDK’s tracing integration for HTTP requests inadvertently captures and includes sensitive HTTP headers in events sent to Sentry. This occurs because the header-filtering logic fails to properly exclude headers like `Cookie` and `Authorization` when `sendDefaultPii` is enabled. The SDK’s `prepareEvent` function, which processes and sanitizes data before transmission, incorrectly allows these specific headers to pass through the filtering mechanism. Consequently, the full HTTP request object, including all its headers, is serialized and attached to the trace data. This serialized trace, containing the sensitive headers, is then transmitted and stored within the user’s Sentry organization, where it becomes accessible to anyone with project or organization-level access, leading to a potential breach of authentication credentials or session tokens.
Platform: Node.js SDKs
Version: 10.11.0-10.26.0
Vulnerability : Information Disclosure
Severity: High
date: 2024
Prediction: 2024-10-15
What Undercode Say:
npm list | grep sentry
// Check your Sentry configuration
const sentryInit = {
dsn: 'YOUR_DSN',
sendDefaultPii: true, // Vulnerable setting
};
Search for leaked headers in Sentry Explore → Traces → "http.request.header.cookie"
How Exploit:
Access Sentry organization. Navigate to Explore and Traces. Search for traces containing “http.request.header.cookie” or “http.request.header.authorization”. Extract sensitive session tokens or credentials from the stored header values. Use captured cookies for session hijacking or authorization headers for API access impersonation.
Protection from this CVE
Upgrade SDK to version 10.27.0 or newer. Set `sendDefaultPii` to `false` if upgrade is impossible. Implement strict access controls for Sentry organization. Regularly audit Sentry traces for leaked sensitive data.
Impact:
Session hijacking. Privilege escalation. Unauthorized application access. Credential theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
