CVE-2024-41656
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Sentry's self-hosted versions where unsanitized HTML payloads from Integration platform integrations can be stored and rendered on the Issues page. Self-hosted Sentry users with untrustworthy integrations are affected, while Sentry SaaS customers are protected by Content Security Policy. The vulnerability allows attackers to execute arbitrary JavaScript in the context of Sentry users.
💻 Affected Systems
- Sentry self-hosted
📦 What is this software?
Sentry by Sentry
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts through stored XSS.
Likely Case
Malicious integrations could inject JavaScript that steals user session tokens or performs unauthorized actions within Sentry.
If Mitigated
With proper CSP enforcement, script execution is blocked, limiting impact to HTML injection without code execution.
🎯 Exploit Status
Exploitation requires control over Integration platform integrations sending payloads to Sentry. The vulnerability is in payload processing, not authentication bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.7.1
Vendor Advisory: https://github.com/getsentry/sentry/security/advisories/GHSA-fm88-hc3v-3www
Restart Required: Yes
Instructions:
1. Backup your Sentry installation and database. 2. Update to Sentry 24.7.1 using your deployment method (Docker, Kubernetes, etc.). 3. Restart Sentry services. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Enable Content Security Policy
allEnable CSP in enforcing mode to block script execution from injected HTML
Set CSP_REPORT_ONLY = False in Sentry configuration
🧯 If You Can't Patch
- Enable and enforce Content Security Policy with CSP_REPORT_ONLY = False
- Audit and restrict Integration platform integrations to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Sentry version: if between 10.0.0 and 24.7.0, you are vulnerableCheck Version:
sentry --version or check Docker image tagVerify Fix Applied:
Verify Sentry version is 24.7.1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual HTML payloads in integration webhook logs
- CSP violation reports if CSP_REPORT_ONLY is enabled
Network Indicators:
- Suspicious HTML/JavaScript in integration payloads to Sentry
SIEM Query:
source="sentry" AND ("integration" OR "webhook") AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")🔗 References
- https://github.com/getsentry/self-hosted/releases/tag/24.7.1
- https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e
- https://github.com/getsentry/sentry/pull/74648
- https://github.com/getsentry/sentry/security/advisories/GHSA-fm88-hc3v-3www
- https://github.com/getsentry/self-hosted/releases/tag/24.7.1
- https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e
- https://github.com/getsentry/sentry/pull/74648
- https://github.com/getsentry/sentry/security/advisories/GHSA-fm88-hc3v-3www
