Practise like a pro Newrelic
Most disclosed vulnerability type (28 disclosures) — Privilege Escalation
jon_bottarini has disclosed the most with 41 reports!
Newrelic's top public payouts
- Newrelic rewarded Stored XSS in notes (charts) because of insecure chart data JSON generation with a
$4,250bounty! - Newrelic rewarded Cross-account stored XSS at embedded charts with a
$3,625bounty! - Newrelic rewarded NR-wide cross account access through misconfigured CORS-policy of multiple endpoints with a
$3,125bounty! - Newrelic rewarded Stored XSS in Brower `name` field reflected in two pages with a
$3,000bounty! - Newrelic rewarded Password theft login.newrelic.com via Request Smuggling with a
$3,000bounty!
Most recently disclosed
"Basic user" which can only access a limited subset of the platform can access certain pages which are restricted to the user by the account owner.
@ Submitted by jhimansh
Bug Type: Improper Access Control - Generic
Disclosed on 2020-09-22
Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter
@ Submitted by jon_bottarini
Bug Type: Insecure Direct Object Reference (IDOR)
Disclosed on 2020-09-04
IDOR via internal_api "users" endpoint
@ Submitted by jon_bottarini
Bug Type: Insecure Direct Object Reference (IDOR)
Disclosed on 2020-09-04
[NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint
@ Submitted by jon_bottarini
Bug Type: Insecure Direct Object Reference (IDOR)
Disclosed on 2020-09-04
[NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894
@ Submitted by jon_bottarini
Bug Type: Insecure Direct Object Reference (IDOR)
Disclosed on 2020-09-04
[NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04
GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted user
@ Submitted by jon_bottarini
Bug Type: Information Disclosure
Disclosed on 2020-09-04
[NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users
@ Submitted by jon_bottarini
Bug Type: Insecure Direct Object Reference (IDOR)
Disclosed on 2020-09-04
[NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04
[NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04
Restricted user can bypass permissions restriction to create NR Alert policies
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04
User is able to access and create private synthetics locations without upgrading (regression of #276157)
@ Submitted by jon_bottarini
Bug Type: Client-Side Enforcement of Server-Side Security
Disclosed on 2020-09-04
[Synthetics/Infrastructure/everything] Individual account permissions are not properly managed and inherited on sub accounts
@ Submitted by jon_bottarini
Bug Type: Business Logic Errors
Disclosed on 2020-09-04
[NR Infrastructure] Restricted user can update integration provider account name via integrations API
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04
Logic flaw enables restricted account to access account license key
@ Submitted by jon_bottarini
Bug Type: Privilege Escalation
Disclosed on 2020-09-04