CVE-2023-51451 json
SSRF in symbolicator via invalid protocol
published 2023-12-22 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-56164
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.
Patch / fix
- sentry symbolicator 23.12.1
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- getsentry symbolicator
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/getsentry/symbolicator/pull/1343
patch
-
github.com
/getsentry/symbolicator/security/advisories/GHSA-ghg9-7m82-h96r
mitigation, patch, vendor-advisory
-
github.com
/getsentry/self-hosted/releases/tag/23.12.1
release-notes
-
github.com
/getsentry/symbolicator/releases/tag/23.12.1
release-notes
Sources
- CVE List CVE-2023-51451
- NVD CVE-2023-51451
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.