PT-2023-33013 · Opentelemetry · @Opentelemetry/Instrumentation

Published 2023-08-09 · Updated 2023-08-09

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions @opentelemetry/instrumentation versions prior to 0.41.2

Description The issue allows for remote code execution when user-supplied input is passed directly to an import() function. This is due to the import-in-the-middle loader generating a wrapper module on the fly, which can be exploited.

Recommendations For versions prior to 0.41.2, update to version 0.41.2 to resolve the issue. As a temporary workaround, do not pass any user-supplied input to import(). Instead, verify it against a set of allowed values. If using @opentelemetry/instrumentation with support for EcmaScript Modules is not needed, ensure that none of the following options are set: --experimental-loader=@opentelemetry/instrumentation/hook.mjs --experimental-loader @opentelemetry/instrumentation/hook.mjs --loader=import-in-the-middle/hook.mjs --loader import-in-the-middle/hook.mjs

Fix

Related Identifiers

GHSA-F8PQ-3926-8GX5

Affected Products

@Opentelemetry/Instrumentation

References · 4

• https://osv.dev/vulnerability/GHSA-f8pq-3926-8gx5 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-js · Note
• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-f8pq-3926-8gx5 · Note
• https://github.com/open-telemetry/opentelemetry-js/commit/ffe641c08c69f41ca8d292221dc1804d511efb28 · Note