CVE-2024-24829

Executive Summary

CVE-2024-24829 is a constrained Server-Side Request Forgery (SSRF) vulnerability in the Phabricator integration of Sentry, an error tracking and performance monitoring platform. The vulnerability affects Sentry versions up to and including 24.1.1. An attacker with access to a Sentry instance can exploit this flaw to make the server send POST HTTP requests to arbitrary URLs, including internal IP addresses, by providing unsanitized input to the Phabricator integration. While the body payload is constrained to a specific format, this allows an attacker to interact with internal network services and scan local/remote ports. The vulnerability has been fixed in Sentry self-hosted release 24.1.2 and was mitigated on sentry.io on February 8, 2024. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Sentry platform itself, which is a Python-based application. Users should ensure they are running the latest patched version from the official Sentry repository.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid account on the Sentry instance.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., port scanning, internal service interaction).
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. The vulnerability requires authentication but allows interaction with internal networks, which could be used for reconnaissance or further attacks.

Deep Dive & Mechanics

The vulnerability resides in the Phabricator integration, which is used to connect Sentry with Phabricator, a code review and project management tool. The integration allows Sentry to send notifications to Phabricator via HTTP requests. The flaw is that the integration does not properly validate or sanitize the URL provided by the user when configuring the integration. An attacker can supply a malicious URL (e.g., http://internal-service:8080/api) that points to an internal network resource.

When Sentry processes an event that triggers the Phabricator integration, it sends a POST request to the attacker-controlled URL. The body of the request is constrained to a specific format (likely JSON with Sentry event data), but the URL itself is not restricted. This allows the attacker to:

1. Interact with internal network services: The attacker can send POST requests to internal services (e.g., databases, configuration management tools) that may be vulnerable to CSRF-like attacks or that accept unauthenticated requests.
2. Scan local/remote ports: By observing response times or error messages, the attacker can determine if a port is open on internal hosts.

The vulnerability is classified as a constrained SSRF because the request body is fixed, limiting the attacker's ability to inject arbitrary data. However, the ability to control the destination URL is sufficient for reconnaissance and potential exploitation of internal services.

Vulnerable vs. Patched Code

The vulnerable code is in the Phabricator integration's request handling logic. The exact code is not publicly available, but the fix likely involves:

• Vulnerable: The integration accepts a user-provided URL without validation.

  # Vulnerable code (conceptual)
  def send_to_phabricator(event, url):
      requests.post(url, json=event_data)
  

• Patched: The integration validates the URL against an allowlist of permitted domains or IP addresses.

  # Patched code (conceptual)
  ALLOWED_DOMAINS = ["phabricator.example.com"]
  def send_to_phabricator(event, url):
      parsed_url = urlparse(url)
      if parsed_url.hostname not in ALLOWED_DOMAINS:
          raise ValueError("Invalid URL")
      requests.post(url, json=event_data)
  

The patch ensures that only URLs pointing to the legitimate Phabricator instance are accepted, preventing SSRF attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Sentry instance (version <= 24.1.1) with a valid user account.
• The Phabricator integration must be enabled and configurable.

Exploitation Steps:

1. Identify a vulnerable Sentry instance: Use Shodan dorks or manual scanning to find Sentry instances.
2. Log in to the Sentry instance with a valid account.
3. Navigate to the Phabricator integration settings (typically under Settings > Integrations > Phabricator).
4. Configure the integration with a malicious URL pointing to an internal service, e.g., http://192.168.1.1:8080/api.
5. Trigger an event that will be sent to the Phabricator integration (e.g., create a new issue or error).
6. Observe the request on the internal service (e.g., via logs or network monitoring) to confirm the SSRF.

Example payload for URL configuration:

http://internal-service:9200/_search

Note: The request body will be Sentry event data, so the attacker cannot control the payload. However, this can still be used for port scanning or interacting with services that accept POST requests.

Blue Team

Detection and Response:

1. Monitor outbound HTTP requests from the Sentry server to unexpected destinations, especially internal IP addresses.
2. Review Phabricator integration configurations for suspicious URLs.
3. Implement network segmentation to restrict outbound traffic from the Sentry server to only necessary external services.
4. Use a web application firewall (WAF) to block requests to internal IP addresses from the Sentry application.
5. Enable logging for all integration-related requests and review logs for anomalies.

Lab Setup:

• Victim: Sentry self-hosted version 24.1.1 running on a server with internal network access.
• Attacker: A machine with network access to the Sentry instance.
• Internal Service: A simple HTTP server (e.g., nc -l -p 8080) to receive the SSRF request.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound POST requests from the Sentry server to internal IP addresses (e.g., 192.168.x.x, 10.x.x.x, 172.16.x.x).
  • Requests to unusual ports (e.g., 9200 for Elasticsearch, 5432 for PostgreSQL).
  • Repeated connection attempts to multiple internal IPs/ports (port scanning behavior).

• Log IOCs:

  • Sentry logs showing integration requests to non-standard URLs.
  • Error logs from internal services receiving unexpected POST requests.

• File IOCs:

  • Modified configuration files for the Phabricator integration containing suspicious URLs.

Detection Engineering

YARA Rule

rule CVE_2024_24829_SSRF_Sentry {
    meta:
        description = "Detects potential SSRF exploitation in Sentry Phabricator integration"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "CVE-2024-24829"
    strings:
        $sentry_log = /Sentry.*Phabricator.*integration.*request.*http:\/\/(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01]))/
        $sentry_config = /phabricator.*url.*http:\/\/(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01]))/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-24829 SSRF in Sentry Phabricator Integration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects outbound POST requests from Sentry to internal IP addresses
author: Valters IT
date: 2024/02/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24829
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image: '*sentry*'
        DestinationIp:
            - '192.168.*'
            - '10.*'
            - '172.16.*'
            - '172.17.*'
            - '172.18.*'
            - '172.19.*'
            - '172.20.*'
            - '172.21.*'
            - '172.22.*'
            - '172.23.*'
            - '172.24.*'
            - '172.25.*'
            - '172.26.*'
            - '172.27.*'
            - '172.28.*'
            - '172.29.*'
            - '172.30.*'
            - '172.31.*'
        Initiated: 'true'
        Protocol: 'tcp'
    condition: selection
falsepositives:
    - Legitimate internal service communication
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24829 SSRF in Sentry Phabricator Integration"; flow:to_server; content:"POST"; http_method; content:"/api"; http_uri; content:"Host: "; http_header; content:"192.168."; within:10; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Sentry to version 24.1.2 or later. This is the official fix.
2. If upgrade is not possible, disable the Phabricator integration until the patch can be applied.
3. Review and restrict outbound network access from the Sentry server using firewall rules.

Long-term Mitigations:

1. Implement network segmentation to limit the Sentry server's access to internal resources.
2. Use a web application firewall (WAF) to block requests to internal IP addresses.
3. Regularly audit integration configurations for suspicious URLs.
4. Monitor logs for unusual outbound HTTP requests.

Workarounds:

• There are no known workarounds for this vulnerability. The only solution is to upgrade or disable the integration.

Valters IT