Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23485

CVE-2022-23485: Sentry vulnerable to invite code reuse via cookie manipulation

6.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23485
GHSA ID
GHSA-jv85-mqxj-3f9j
EPSS Score
0.16269%
CWE
CWE-269
Published
12/12/2022
Updated
10/22/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
sentrypip>= 20.6.0, < 22.11.022.11.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from storing invite code details (memberId and token) in a client-side cookie ('pending-invite') via add_invite_cookie. Since cookies are client-controlled, attackers could modify these values to reuse valid invites. The commit patched this by moving storage to server-side sessions (add_invite_details_to_session) and removing all cookie-based functions. The vulnerable functions directly handled the insecure cookie storage mechanism that enabled the exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Wit* * known v*li* invit* link (i.*. not *lr***y ****pt** or *xpir**) *n un*ut**nti**t** *tt**k*r **n m*nipul*t* t** *ooki* to *llow t** s*m* invit* link to ** r*us** on multipl* ***ounts w**n joinin* *n or**niz*tion. ### Imp**t *n *tt**k*r wit* * v

Reasoning

T** vuln*r**ility st*mm** *rom storin* invit* *o** **t*ils (m*m**rI* *n* tok*n) in * *li*nt-si** *ooki* ('p*n*in*-invit*') vi* ***_invit*_*ooki*. Sin** *ooki*s *r* *li*nt-*ontroll**, *tt**k*rs *oul* mo*i*y t**s* v*lu*s to r*us* v*li* invit*s. T** *om