Read the docs
TI-2023-28105 Aliases CVE-2023-51451

SSRF in symbolicator via invalid protocol

Priority LOW 20CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.

Why it matters now

EPSS 0.00471 40th percentileScored 2026-11-07
Fix Fixed symbolicator (getsentry): 23.12.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysymbolicator0.3.3 to before 23.12.123.12.1Patch availableCNA
  • symbolicator Vendorgetsentry Affected 0.3.3 to before 23.12.1 Fixed in 23.12.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:symbolicator:*:*:*:*:*:*:*:*0.3.3 to before 23.12.1VulnerableSentry
  • cpe:2.3:a:sentry:symbolicator:*:*:*:*:*:*:*:* Versions 0.3.3 to before 23.12.1 Vulnerable ·Sentry

Remediation

  • Fix · CNA symbolicator (getsentry) Fixed in 23.12.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-51451

References

Patch 2

Other 2

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences