PT-2024-40120 · Sentry · Sentry-React-Native

Published 2024-03-01 · Updated 2024-03-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: sentry-react-native versions 5.16.0 through 5.19.0

Description: The issue allows Sentry auth tokens to be set in the optional authToken configuration parameter for debugging purposes, which could result in the auth token being built into the application bundle and potentially exposed if the application bundle is published.

Recommendations: For sentry-react-native versions 5.16.0 through 5.19.0, remove the authToken from the plugin configuration to prevent potential exposure. If you had set the authToken in the plugin config previously and built and published an app with that config, rotate your token. For versions 5.19.1 and later, the behavior that allowed setting an authToken parameter is fixed, and setting this parameter will result in a warning and the authToken being removed before bundling the application.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-68C2-4MPX-QH95

Affected Products

Sentry-React-Native

References · 5

• https://osv.dev/vulnerability/GHSA-68c2-4mpx-qh95 · Vendor Advisory
• https://github.com/getsentry/sentry-react-native/releases/tag/5.19.1 · Note
• https://github.com/getsentry/sentry-react-native/security/advisories/GHSA-68c2-4mpx-qh95 · Note
• https://github.com/getsentry/sentry-react-native/commit/9148964a50d2ea1de830854c95f3649f6cb94b1b · Note
• https://github.com/getsentry/sentry-react-native · Note