CVE-2024-53253

Executive Summary

CVE-2024-53253 is a medium-severity information disclosure vulnerability affecting Sentry version 24.11.0 only. The flaw occurs when a Search UI component with the async flag set to true triggers a request to a third-party integration. If that third-party response fails validation, Sentry returns a select-requester.invalid-response error containing a serialized Sentry application object, which includes the plaintext Client ID and Client Secret. While the secret alone does not grant direct access, an attacker with a valid API token could leverage it for unauthorized actions. Sentry SaaS users are not impacted; only self-hosted instances running version 24.11.0 with custom integrations are at risk. The patch is available via pull request 81038.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the Sentry platform itself. Self-hosted users should treat this as a critical supply chain risk if they maintain custom integrations, as the leaked credentials could be used in downstream attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (Client Secret exposure)
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) indicates no active exploitation in the wild, but the vulnerability is trivial to trigger and could be chained with other attacks.

Deep Dive & Mechanics

The vulnerability resides in the select_requester.py module. When a Search UI component with async set to true sends a request to a third-party integration, the response is validated. If validation fails, the error handler serializes the entire Sentry application object (including client_id and client_secret) into the error message. This error is returned in the HTTP response body, even though the UI does not display it.

The affected code path is:

1. User types in Search UI → request to third-party.
2. Third-party returns invalid response.
3. Sentry catches the error and generates select-requester.invalid-response.
4. The error includes a serialized SentryApp object with plaintext credentials.

The fix in PR 81038 removes the serialization of the application object from the error response, ensuring credentials are not leaked.

Vulnerable vs. Patched Code

Vulnerable (24.11.0):

# select_requester.py (simplified)
def handle_response(response):
    if not validate(response):
        raise InvalidResponseError(
            f"select-requester.invalid-response: {serialize(sentry_app)}"
        )

Patched (PR 81038):

# select_requester.py (simplified)
def handle_response(response):
    if not validate(response):
        raise InvalidResponseError("select-requester.invalid-response")

The patched version removes the serialize(sentry_app) call, preventing credential leakage.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Sentry self-hosted instance running 24.11.0.
• A Search UI component with async flag set to true (default).
• A third-party integration that can be made to return an invalid response.

Exploitation Steps:

1. Identify a Sentry instance with a Search UI component.
2. Trigger a search that queries a third-party integration.
3. Intercept the request and modify the third-party response to be invalid (e.g., malformed JSON).
4. Observe the HTTP response for select-requester.invalid-response error.
5. Extract the client_id and client_secret from the serialized object.

Example cURL:

curl -X POST "https://target-sentry.com/api/0/search/" \
  -H "Content-Type: application/json" \
  -d '{"query": "test", "async": true}' \
  -v 2>&1 | grep -o '"client_secret":"[^"]*"'

Blue Team

Detection:

• Monitor for select-requester.invalid-response events in Sentry logs.
• Check HTTP responses for serialized application objects containing client_secret.
• Alert on any error response containing client_id or client_secret fields.

Mitigation:

• Immediately upgrade to patched version or downgrade to 24.10.0.
• Rotate any Client Secrets that may have been exposed.
• Review logs for unauthorized access to integrations.

Indicators of Compromise (IOCs)

• Log Entry: select-requester.invalid-response event in Sentry error logs.
• HTTP Response Pattern: JSON containing "client_id" and "client_secret" fields.
• Error Code: HTTP 400 with body containing select-requester.invalid-response.
• Affected Version: Sentry 24.11.0 only.

Detection Engineering

YARA Rule

rule sentry_credential_leak_cve_2024_53253 {
    meta:
        description = "Detects Sentry error responses containing leaked Client ID and Client Secret"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-53253"
    strings:
        $error_code = "select-requester.invalid-response"
        $client_id = /"client_id"\s*:\s*"[a-f0-9]{32}"/ nocase
        $client_secret = /"client_secret"\s*:\s*"[a-f0-9]{64}"/ nocase
    condition:
        $error_code and ($client_id or $client_secret)
}

Sigma Rule

title: Sentry Client Secret Leak via Invalid Response Error
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing Sentry application credentials in error messages
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53253
logsource:
    category: webserver
    product: sentry
detection:
    selection:
        response_body|contains: "select-requester.invalid-response"
        response_body|contains: "client_secret"
    condition: selection
falsepositives:
    - Legitimate debugging sessions
level: high

Suricata Rule

alert http any any -> any any (msg:"Sentry Client Secret Leak CVE-2024-53253"; flow:to_server,established; content:"select-requester.invalid-response"; http_server_body; content:"client_secret"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Sentry SaaS: No action needed; only one integration was impacted and the secret has been rotated.
2. Sentry Self-Hosted:
   • Do not install version 24.11.0.
   • If running 24.11.0, downgrade to 24.10.0 or apply the patch from PR 81038.
   • Rotate all Client Secrets for custom integrations.
   • Search logs for select-requester.invalid-response events and review parameters.

Long-Term Mitigation:

• Implement input validation for third-party responses.
• Avoid serializing sensitive objects in error messages.
• Use a secrets management solution to rotate credentials automatically.

Valters IT
DevSecOps & Cyber Threat Intelligence