CVE-2023-46729: Sentry JavaScript SDK SSRF Vulnerability

CVE-2023-46729 Overview

CVE-2023-46729 is a Server-Side Request Forgery (SSRF) vulnerability in the Sentry JavaScript SDK (sentry-javascript) affecting Next.js applications. The vulnerability exists in the SDK's tunnel endpoint feature, where unsanitized input allows attackers to send HTTP requests to arbitrary URLs and have the response reflected back to them. This issue specifically impacts users who have enabled the Next.js SDK tunneling feature.

Critical Impact
Attackers can abuse the tunnel endpoint to perform server-side requests to internal services, exfiltrate sensitive data, or use the vulnerable server as a proxy to attack other systems while masking their origin.

Affected Products

Sentry JavaScript SDK for Next.js (versions prior to 7.77.0)
Applications using the Sentry Next.js SDK with tunneling feature enabled
Next.js applications integrating vulnerable sentry-javascript packages

Discovery Timeline

2023-11-10 - CVE CVE-2023-46729 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-46729

Vulnerability Analysis

The vulnerability stems from insufficient input validation in the Next.js SDK tunnel configuration. The tunneling feature is designed to bypass ad-blockers by routing Sentry telemetry data through the application's own domain. However, the regex patterns used to validate organization ID (orgId) and project ID (projectId) query parameters were overly permissive, accepting arbitrary input rather than enforcing strict format requirements.

The original regex pattern (?<orgid>.*) for the organization ID and (?<projectid>.*) for the project ID allowed any string value. An attacker could craft malicious requests that inject arbitrary destinations into the tunnel endpoint, causing the server to make requests to attacker-controlled or internal URLs and return the responses.

Root Cause

The root cause is improper input validation (CWE-918: Server-Side Request Forgery). The tunnel endpoint configuration in packages/nextjs/src/config/withSentryConfig.ts used wildcard regex patterns that failed to restrict the format of incoming parameters. The orgId parameter should only contain hexadecimal characters representing a valid Sentry organization identifier, and the projectId should only contain numeric digits.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by:

Identifying a Next.js application using the Sentry SDK with tunneling enabled
Crafting malicious HTTP requests to the tunnel endpoint with manipulated o (orgId) and p (projectId) query parameters
Injecting arbitrary URL components through these parameters
Receiving reflected responses from internal services or external targets

The security patch tightens the regex validation to prevent arbitrary input:

typescript

         {
           type: 'query',
           key: 'o', // short for orgId - we keep it short so matching is harder for ad-blockers
-          value: '(?<orgid>.*)',
+          value: '(?<orgid>[a-fA-F0-9]*)',
         },
         {
           type: 'query',
           key: 'p', // short for projectId - we keep it short so matching is harder for ad-blockers
-          value: '(?<projectid>.*)',
+          value: '(?<projectid>\\d*)',
         },
       ],
       destination: 'https://o:orgid.ingest.sentry.io/api/:projectid/envelope/?hsts=0',

Source: GitHub Commit ddbda3c

Detection Methods for CVE-2023-46729

Indicators of Compromise

Unusual outbound HTTP requests originating from the Next.js application server to internal network addresses
Requests to the Sentry tunnel endpoint containing non-standard characters in the o or p query parameters
Server logs showing tunnel requests with malformed organization or project identifiers
Network traffic to unexpected external destinations from the application server

Detection Strategies

Monitor application logs for tunnel endpoint requests with query parameters containing characters outside the expected format (non-hexadecimal for o, non-numeric for p)
Implement web application firewall (WAF) rules to detect SSRF patterns in requests to known Sentry tunnel paths
Use network segmentation monitoring to identify anomalous outbound connections from Next.js application servers
Review Sentry SDK configuration to verify if tunneling is enabled and which version is deployed

Monitoring Recommendations

Enable detailed logging on the Next.js application to capture all requests to the tunnel endpoint
Set up alerts for outbound connections to internal RFC 1918 IP ranges from the application server
Monitor for unusual response sizes or timing patterns from tunnel endpoint requests
Implement egress filtering to restrict which external destinations the application server can contact

How to Mitigate CVE-2023-46729

Immediate Actions Required

Upgrade the Sentry JavaScript SDK to version 7.77.0 or later immediately
If immediate upgrade is not possible, disable the Next.js SDK tunneling feature temporarily
Audit application logs for any signs of exploitation prior to patching
Review network egress rules to limit outbound connections from application servers

Patch Information

The vulnerability has been fixed in Sentry JavaScript SDK version 7.77.0. The patch implements strict regex validation for the tunnel endpoint parameters, ensuring that organization IDs only contain hexadecimal characters ([a-fA-F0-9]*) and project IDs only contain digits (\\d*). Users should update their @sentry/nextjs package to the patched version.

For detailed information about the fix, refer to:

Workarounds

Disable the Sentry tunneling feature by removing or commenting out the tunnel configuration option in your Sentry Next.js setup
Implement a reverse proxy or WAF rule to validate tunnel endpoint parameters before they reach the application
Use network-level controls to restrict outbound connections from the Next.js server to only necessary destinations

bash

# Update Sentry JavaScript SDK to patched version
npm update @sentry/nextjs@^7.77.0

# Or using yarn
yarn upgrade @sentry/nextjs@^7.77.0

# Verify installed version
npm list @sentry/nextjs