# Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR)

New Relic's 'Get as image' endpoint failed to validate account_id ownership, letting any user pull NRQL data from any account via IDOR.

- Payout: $2,500
- Severity: high
- Program: New Relic
- Credited: Jon Bottarini
- Disclosed: 2018-10-09
- Write-up quality: 7/10
- Original: https://jonbottarini.com/2018/10/09/get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor/
- Library page: https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2018-10-09-get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor
- Tags: domain:web3 impact:data-leak kind:bounty platform:blog sev:high tech:rest technique:recon vuln:access-control vuln:idor

**Target:** Dashboard 'Get as image' image-generation endpoint (/v2/nrql)
**Root cause:** Backend authentication proxy skipped account validation for a specific combination of application configuration options, so the account_id in the image request was never checked against the requesting user.
**Steps:**
1. Send POST to the dashboard image endpoint with body `{"query":{"account_id":1523936,"nrql":"SELECT count(*) FROM IntegrationError FACET dataSourceName SINCE 1 DAY AGO"},"account_id":1523936,"endpoint":"/v2/nrql","title":"Authentication Errors"}`
2. Change both account_id values to a victim account number; response returns data for that account
3. Read `X-Image-Url: http://gorgon.nr-assets.net/image/{UNIQUE_ID}` from the response
4. Append `?type=json` to the image URL to get a JSON dump instead of a chart; invalid type reveals permitted types
5. Append `&height=2000` to maximize data returned per request
6. Automate account_id increment in Burp Intruder to enumerate all accounts
**How found:** Noticed the 'Get as image' option unique to integration dashboards, inspected the POST request, hypothesized the account_id was user-controlled, and tested by swapping it to another account number.
**Exploitation:** Authenticated user swaps account_id in the image-generation request to any other New Relic account, then fetches the returned X-Image-Url with ?type=json&height=2000 to exfiltrate arbitrary NRQL query results (e.g. SELECT * FROM SystemSample) from victim accounts; account IDs are incremental so mass enumeration is trivial.
**Escalation:** Switching chart type to json and increasing height to dump more data per request; Intruder over incremental account IDs to scale to all accounts.
**Insight:** Feature-specific endpoints (image/chart renderers) often bypass the auth checks applied to the main dashboard API; probe secondary render/export endpoints and inspect response headers like X-Image-Url for alternate output formats (?type=json) that leak more than the UI shows.