CVE-2023-50249
📋 TL;DR
A Regular Expression Denial of Service (ReDoS) vulnerability in Sentry's Astro SDK allows attackers to cause excessive server computation times, leading to denial of service. This affects users of Sentry-Javascript Astro SDK versions 7.78.0 through 7.86.0. The vulnerability has been patched in version 7.87.0.
💻 Affected Systems
- Sentry-Javascript Astro SDK
📦 What is this software?
Astro by Sentry
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, affecting all users of the vulnerable application.
Likely Case
Degraded performance and intermittent service disruptions under targeted attack.
If Mitigated
Minimal impact with proper monitoring and rate limiting in place.
🎯 Exploit Status
ReDoS vulnerabilities typically require sending specially crafted input to trigger the vulnerable regex pattern.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.87.0
Vendor Advisory: https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72
Restart Required: Yes
Instructions:
1. Update package.json to use sentry/astro version 7.87.0 or higher. 2. Run npm update or yarn upgrade. 3. Restart your application server.
🔧 Temporary Workarounds
Rate Limiting
allImplement rate limiting on endpoints that process user input to reduce impact of DoS attempts.
Input Validation
allAdd strict input validation and length limits on user-supplied data before processing.
🧯 If You Can't Patch
- Implement WAF rules to block suspicious regex patterns
- Monitor CPU usage and set up alerts for abnormal spikes
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for sentry/astro version between 7.78.0 and 7.86.0Check Version:
npm list @sentry/astro or check package.jsonVerify Fix Applied:
Verify sentry/astro version is 7.87.0 or higher in package.json and dependencies📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage
- Slow response times
- Process timeouts
Network Indicators:
- Spike in request volume to specific endpoints
- Repeated patterns in request payloads
SIEM Query:
source="application_logs" AND (message="CPU spike" OR message="timeout" OR message="slow response")🔗 References
- https://github.com/getsentry/sentry-javascript/commit/fe24eb5eefa9d27b14b2b6f9ebd1debca1c208fb
- https://github.com/getsentry/sentry-javascript/pull/9815
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72
- https://github.com/getsentry/sentry-javascript/commit/fe24eb5eefa9d27b14b2b6f9ebd1debca1c208fb
- https://github.com/getsentry/sentry-javascript/pull/9815
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72
