CVE-2024-24829

    Dashboard / Vulnerabilities / CVE-2024-24829

    CVE-2024-24829

    Published: 8 Feb 2024Last Modified: 28 Oct 2026

    Summary: SSRF in Sentry via Phabricator integration

    Details: Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/getsentry/self-hosted/releases/tag/24.1.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24829.json, https://github.com/getsentry/sentry/security/advisories/GHSA-rqxh-fp9p-p98r, https://nvd.nist.gov/vuln/detail/CVE-2024-24829, https://github.com/getsentry/sentry/pull/64882

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c63e838a211233e196eac9cb2effc7e7d6603587

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High