CVE-2022-23485

Sentry Python library < 22.11.0 invite link reuse vulnerability

• CVSS 3.7
• CWE-269 Improper Privilege Management
• Input Validation and Sanitization
• Remote

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

CVE

CVE-2022-23485

CWE

CWE-269 Improper Privilege Management

CVSS base score

3.7

Published

2022-12-10

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update sentry python library to version 22.11.0 or higher.

def join_organization(invite_link, user_id):
    if is_valid_invite(invite_link):
        add_user_to_organization(invite_link, user_id)
    else:
        raise ValueError("Invalid invite link")

def attacker_join_with_reused_invite(invite_link, user_id):
    join_organization(invite_link, user_id)

def attacker_join_with_reused_invite(invite_link, user_id):
    join_organization(invite_link, user_id)

def join_organization(invite_link, user_id):
    if is_valid_invite(invite_link) and not has_invite_been_used(invite_link):
        add_user_to_organization(invite_link, user_id)
        mark_invite_as_used(invite_link)
    else:
        raise ValueError("Invalid or already used invite link")

@misc{vaitp:cve202223485,
  title        = {{Sentry Python library < 22.11.0 invite link reuse vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-23485},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-23485/}}
}