GHSA-68c2-4mpx-qh95: @sentry/react native Potential Leakage Of Sentry Auth Vulnerability
LOWGHSA-68c2-4mpx-qh95 is a LOW potential leakage of sentry auth vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting @sentry/react native libraries in the npm ecosystem. The issue involves potential leakage of sentry auth tokens by react native sdk with expo plugin. Remediation is available by upgrading affected packages to version 5.19.1.
GHSA-68c2-4mpx-qh95 at a Glance
How to Fix GHSA-68c2-4mpx-qh95
To remediate this vulnerability, upgrade all affected @sentry/react native dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @sentry/react-native@5.19.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @sentry/react-nativeHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-68c2-4mpx-qh95, inspect your project dependencies using npm:
npm ls @sentry/react-nativeAnalyze the terminal output to locate any version of @sentry/react native in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.19.1), your application is affected.
Note: The npm ls @sentry/react-native command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In @sentry/react native, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-68c2-4mpx-qh95 Affected @sentry/react native Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@sentry/react-native
|
npm |
≥ 5.16.0
< 5.19.1
|
5.19.1
|
References
Frequently Asked Questions
What is GHSA-68c2-4mpx-qh95?
Which @sentry/react native versions are affected?
What version fixes GHSA-68c2-4mpx-qh95?
Is @sentry/react-native affected?
What CWE is associated with GHSA-68c2-4mpx-qh95?
How can I check npm dependencies for GHSA-68c2-4mpx-qh95?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-68c2-4mpx-qh95",
"modified" : "2024-03-01T16:57:56Z",
"published" : "2024-03-01T16:57:56Z",
"aliases" : [ ],
"summary" : "Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin",
"details" : "### Impact\nSDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be potentially exposed in case the application bundle is subsequently published.\n\nYou may ignore this notification if you are not using `authToken` configuration parameter in your React Native SDK configuration or did not publish apps using this way of configuring the `authToken`.\n\nIf you had set the `authToken` in the plugin config previously, and built and published an app with that config, you should [rotate your token](https://docs.sentry.io/product/accounts/auth-tokens/).\n\n### Patches\nThe behavior that allowed setting an `authToken` parameter was fixed in SDK version 5.19.1 where, if this parameter was set, you will see a warning and the `authToken` would be removed before bundling the application.\n\n### Workarounds\n1. Remove `authToken` from the plugin configuration.\n2. If you had set the `authToken` in the plugin config previously, and built and published an app with that config, you should [rotate your token](https://docs.sentry.io/product/accounts/auth-tokens/).\n\n### References\n* [sentry-react-native 5.19.1 release notes](https://github.com/getsentry/sentry-react-native/releases/tag/5.19.1)\n* https://github.com/getsentry/sentry-docs/pull/9244",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@sentry/react-native"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.16.0"
}, {
"fixed" : "5.19.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.19.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/getsentry/sentry-react-native/security/advisories/GHSA-68c2-4mpx-qh95"
}, {
"type" : "WEB",
"url" : "https://github.com/getsentry/sentry-react-native/commit/9148964a50d2ea1de830854c95f3649f6cb94b1b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/getsentry/sentry-react-native"
}, {
"type" : "WEB",
"url" : "https://github.com/getsentry/sentry-react-native/releases/tag/5.19.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2024-03-01T16:57:56Z",
"nvd_published_at" : null
}
}