CVE-2024-41656

Executive Summary

CVE-2024-41656 is a stored cross-site scripting (XSS) vulnerability affecting Sentry, an error tracking and performance monitoring platform. The flaw resides in the handling of payloads from Integration platform integrations. An unsanitized payload can store arbitrary HTML tags on the Sentry side, which are later rendered on the Issues page. This allows an attacker who controls an integration (or compromises one) to inject malicious scripts that execute in the context of a user viewing the affected issue.

The vulnerability impacts self-hosted Sentry instances running versions 10.0.0 through 24.7.1. Sentry SaaS customers are not affected due to a strict Content Security Policy (CSP) already in place. The CVSS score is 7.1 (High), with a low EPSS score of 0.0% indicating limited active exploitation at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

Sentry is a Python-based application (Django) with a JavaScript frontend (React). The vulnerability is not in a direct dependency but in the application logic handling integration payloads. However, the risk is amplified if the integration itself is compromised or if the integration platform is untrustworthy. Self-hosted users should verify the integrity of their Sentry installation and any connected integrations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires an authenticated integration user or compromised integration token.
• User Interaction: Required (UI:R) – a user must view the malicious issue page.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible.
• Integrity Impact: Low (I:L) – ability to modify content on the Issues page.
• Availability Impact: Low (A:L) – potential for denial of service via script errors.

Threat Level: High for self-hosted instances without CSP. Low for SaaS customers.

Deep Dive & Mechanics

The vulnerability exists in the way Sentry processes external issue data from Integration platform integrations (e.g., GitHub, Jira, etc.). When an integration sends an issue payload, Sentry stores the raw HTML content without proper sanitization. This stored HTML is later rendered on the Issues page, allowing an attacker to inject arbitrary HTML and JavaScript.

Root Cause: Lack of input sanitization on the description or title fields of the integration payload. Sentry’s backend does not strip or encode HTML tags before storing them in the database.

Attack Flow:

1. An attacker gains control of an integration (e.g., by compromising an API token or exploiting a vulnerability in the integration platform).
2. The attacker sends a crafted issue payload containing malicious HTML/JavaScript (e.g., <script>alert('XSS')</script>).
3. Sentry stores this payload in its database.
4. When a user views the issue on the Issues page, the malicious script executes in the user’s browser.

Why SaaS is Safe: Sentry’s SaaS deployment uses a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources. This prevents the injected script from executing even if stored.

Vulnerable vs. Patched Code

Vulnerable Code (pre-24.7.1):

# In integration handler, no sanitization
def handle_integration_issue(integration, payload):
    issue = Issue.objects.create(
        title=payload['title'],
        description=payload['description'],
        # ...
    )
    return issue

Patched Code (24.7.1+):

# Using bleach or similar to sanitize HTML
import bleach

def handle_integration_issue(integration, payload):
    sanitized_title = bleach.clean(payload['title'], tags=[], strip=True)
    sanitized_description = bleach.clean(payload['description'], tags=[], strip=True)
    issue = Issue.objects.create(
        title=sanitized_title,
        description=sanitized_description,
        # ...
    )
    return issue

The patch introduces HTML sanitization using the bleach library, stripping all tags and encoding special characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Sentry integration (e.g., a compromised GitHub webhook token).
• Target self-hosted Sentry instance (version < 24.7.1) without CSP enforcement.

Exploitation Steps:

1. Identify the integration endpoint (e.g., POST /api/0/organizations/{org}/issues/).
2. Craft a malicious payload:

   {
     "title": "Normal Issue",
     "description": "<img src=x onerror=alert(document.cookie)>",
     "integration": "github"
   }
   

3. Send the payload via the integration API.
4. Wait for a user to view the issue. The XSS triggers.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

Detection:

• Monitor integration API logs for unusual payloads containing HTML tags.
• Use WAF rules to block <script>, <img onerror>, etc., in integration payloads.
• Enable CSP in enforcing mode (CSP_REPORT_ONLY = False).

Hardening:

• Upgrade to Sentry 24.7.1 or later.
• For self-hosted, add CSP headers:

  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;
  

• Restrict integration tokens to least privilege.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/0/organizations/*/issues/ with HTML tags in JSON body.
• Logs: Sentry logs showing Integration issue created with suspicious description or title fields.
• Database: Rows in issues table containing <script>, <img onerror>, or other HTML event handlers.
• File System: No file-based IOCs.

Detection Engineering

YARA Rule

rule sentry_stored_xss_payload {
    meta:
        description = "Detects stored XSS payloads in Sentry integration data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41656"
    strings:
        $html_tag = /<[^>]+>/
        $script_tag = /<script[^>]*>/
        $event_handler = /on\w+\s*=\s*['"]/
    condition:
        any of ($html_tag) and any of ($script_tag, $event_handler)
}

Sigma Rule

title: Sentry Stored XSS via Integration Payload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious HTML tags in Sentry integration issue creation
author: Valters IT
logsource:
    category: application
    product: sentry
detection:
    selection:
        event: "integration.issue.created"
        payload|contains:
            - "<script"
            - "<img"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate HTML in issue descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Sentry Stored XSS - Integration Payload with HTML Tags";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/0/organizations/"; http_uri;
    content:"issues"; http_uri;
    pcre:"/<[^>]+>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade to Sentry 24.7.1 or later.
• For self-hosted, enable CSP enforcing mode: CSP_REPORT_ONLY = False in sentry.conf.py.

Long-term:

• Implement input sanitization for all integration payloads.
• Regularly audit integration tokens and permissions.
• Monitor for unusual integration activity.

Workaround:

• If upgrade is not possible, manually add CSP headers via reverse proxy (Nginx/Apache) to block inline scripts.

Valters IT