CVE-2024-40647

Bug in Sentry SDK < 2.8.0 allows unintended environment variable exposure.

• CVSS 5.3
• CWE-200
• Information Leakage
• Local

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

CVE

CVE-2024-40647

CWE

CWE-200

CVSS base score

5.3

Published

2024-07-18

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Local

Impact

Information Disclosure

Affected component

sentry-sdk

Fixed by upgrading

Yes

Solution

Upgrade to sentry-sdk version 2.8.0 or later.

import os
import subprocess
from sentry_sdk import init
from sentry_sdk.integrations.stdlib import StdlibIntegration

init(dsn="your_dsn_here", integrations=[StdlibIntegration()])

os.environ["SECRET_KEY"] = "my_secret_key"

subprocess.call(["printenv"], env={})

import os
import subprocess
from sentry_sdk import init
from sentry_sdk.integrations.stdlib import StdlibIntegration

init(dsn=os.getenv("SENTRY_DSN", ""), integrations=[StdlibIntegration()])

os.environ["SECRET_KEY"] = "my_secret_key"

safe_env = {key: os.environ[key] for key in ("PATH", "HOME") if key in os.environ}

subprocess.call(["printenv"], env=safe_env)

import os
import subprocess
from sentry_sdk import init

# Initialize Sentry SDK (vulnerable version < 2.8.0)
init(dsn="your_dsn_here")

# Set a sensitive environment variable
os.environ["SENSITIVE_DATA"] = "exploit_this"

# Vulnerable subprocess call that exposes the sensitive data
subprocess.call(["printenv"])

@misc{vaitp:cve202440647,
  title        = {{Bug in Sentry SDK < 2.8.0 allows unintended environment variable exposure.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-40647},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-40647/}}
}