PT-2024-26374 · Sentry · Sentry

Asottile · Published 2024-05-31 · Updated 2024-06-02 · CVE-2024-35196

Positive Technologies (AI Summary)

CVSS v3.1

2.0

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 24.5.0

Description Sentry's Slack integration incorrectly records the incoming request body in logs, which can contain sensitive information, including the deprecated Slack verification token. This token can be used by an attacker to forge requests and act as the Slack integration under specific configurations. The request body is leaked in log entries matching event == "slack.*" && name == "sentry.integrations.slack" && request data == *, with the deprecated slack verification token found in the request data.token key.

Recommendations For self-hosted users, upgrade to version 24.5.0 or higher, rotate the Slack verification token, and use the Slack Signing Secret instead of the verification token. As a temporary workaround, set the slack.signing-secret instead of slack.verification-token to prevent the use of the verification token for authentication. Alternatively, adjust the logging configuration to not generate logs from the integration by routing logs to a null handler and preventing generation of logs at lower levels. Services should be restarted once the configuration change is saved.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-35196

GHSA-C2G2-GX4J-RJ3J

Affected Products

Sentry

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35196.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-35196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35196 · Security Note
• https://osv.dev/vulnerability/GHSA-c2g2-gx4j-rj3j · Vendor Advisory
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/sentry/security/advisories/GHSA-c2g2-gx4j-rj3j · Note
• https://github.com/getsentry/sentry/pull/70508 · Note
• https://github.com/getsentry/sentry/blob/17d2b87e39ccd57e11da4deed62971ff306253d1/src/sentry/conf/server.py#L1307 · Note
• https://api.slack.com/authentication/verifying-requests-from-slack#regenerating · Note
• https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates · Note
• https://api.slack.com/authentication/verifying-requests-from-slack#deprecation · Note
• https://develop.sentry.dev/integrations/slack · Note