PT-2024-24366 · Opentelemetry · Opentelemetry.Instrumentation.Aspnetcore+1

Ilyagrebnov · Published 2024-04-12 · Updated 2024-04-15 · CVE-2024-32028

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Instrumentation.Http versions prior to 1.8.1 OpenTelemetry.Instrumentation.AspNetCore versions prior to 1.8.1

Description The issue concerns the OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore components of the OpenTelemetry dotnet framework. In affected versions, the url.full and url.query attributes/tags are written on spans (Activity) when tracing is enabled for outgoing and incoming HTTP requests, respectively. These attributes, defined by the Semantic Conventions for HTTP Spans, may pass through raw query strings, potentially leading to the leakage of sensitive information, such as End User Identifiable Information (EUII) or credentials, into telemetry backends. This could cause privacy and/or security incidents.

Recommendations To resolve the issue, upgrade to version 1.8.1 or later of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore, as these versions redact by default all values detected on transmitted or received query strings. For versions prior to 1.8.1, consider temporarily disabling the tracing of HTTP requests or restricting access to sensitive information until an upgrade is possible.

Exploit

Fix

Weakness Enumeration

CWE-201

CWE-212

Related Identifiers

CVE-2024-32028

GHSA-VH2M-22XX-Q94F

Affected Products

Opentelemetry.Instrumentation.Aspnetcore

@Opentelemetry/Instrumentation

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32028.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-32028 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh2m-22xx-q94f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32028 · Security Note
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42 · Note
• https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md · Note
• https://t.me/cvenotify/76653 · Telegram Post
• https://twitter.com/CVEnew/status/1779016052254630348 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778954265232392419 · Twitter Post