A security update for New Relic's .NET agent fixes a vulnerability where the agent could unintentionally capture service request parameters from WCF applications.
Release date: May 4, 2017
Vulnerability identifier: NR17-04
The following New Relic agent versions are affected:
184.108.40.206 (and greater)
New Relic’s .NET Agent version 220.127.116.11 added visibility into Error Analytics. By default the agent will capture error events, and with WCF applications this is captured as event type TransactionError. New Relic has found that the service.request.* attributes may contain sensitive information that should not be sent to New Relic. A fix has been made to disable the collection of these parameters during the error collection. Customers are encouraged to upgrade to the latest version of the .NET agent.
- Only .NET agents with Error Analytics and WCF applications are affected.
- All service request attributes are disabled in High Security Mode.
Users who are affected and unable to upgrade may choose to manually configure the .NET agent to not capture service request parameters. Users can exclude service.request.* attributes from the errorCollector stanza in their newrelic.config file.
<attributes enabled="true"><exclude > service.request.*</exclude></attributes>
For details please refer to our .NET agent Error Collector configuration
New Relic is committed to the security of our customers and their data. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic's coordinated disclosure program. For more information, see Reporting security vulnerabilities.
Additional documentation resources include:.