CVE-2024-32028

Executive Summary

CVE-2024-32028 is a medium-severity information disclosure vulnerability affecting the OpenTelemetry .NET instrumentation libraries for HTTP and ASP.NET Core. The vulnerability allows sensitive data, such as credentials or personally identifiable information (PII), present in HTTP query strings to be inadvertently captured and transmitted to telemetry backends. This occurs because the url.full and url.query attributes on spans (Activity) are written with the raw, unredacted query string. The issue is fixed in version 1.8.1 of the affected packages, which introduces default redaction of query string values.

Supply Chain & Package Security

This vulnerability is specific to the NuGet ecosystem, affecting the OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore packages. Organizations using these packages in their .NET applications should treat this as a supply chain security concern, as the instrumentation libraries are responsible for handling telemetry data. The fix requires updating the NuGet package references in the project files.

CVSS Breakdown & Threat Level

• CVSS Score: 4.1 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No impact on availability.

The threat level is considered medium due to the potential for sensitive data leakage into telemetry systems, which could be accessed by unauthorized parties if the telemetry backend is not properly secured.

Deep Dive & Mechanics

The vulnerability lies in how the OpenTelemetry .NET instrumentation libraries handle HTTP request and response data. When tracing is enabled, the libraries automatically capture attributes for spans (Activity) based on the OpenTelemetry Semantic Conventions for HTTP.

• OpenTelemetry.Instrumentation.Http: For outgoing HTTP requests, it writes the url.full attribute, which includes the full URL with the query string.
• OpenTelemetry.Instrumentation.AspNetCore: For incoming HTTP requests, it writes the url.query attribute, which contains the raw query string.

Prior to version 1.8.1, these attributes were written with the exact query string as sent or received. This means that if an application includes sensitive data in query parameters (e.g., ?token=abc123&user=john.doe@example.com), that data would be captured and sent to the configured telemetry backend (e.g., Jaeger, Zipkin, Azure Monitor, etc.).

The vulnerability is not about the telemetry backend itself, but about the instrumentation layer failing to sanitize the data before transmission. The fix in version 1.8.1 introduces default redaction of all values in query strings, replacing them with a placeholder (e.g., [REDACTED]).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.1):

The vulnerable code directly passes the query string to the span attribute without any sanitization.

// In OpenTelemetry.Instrumentation.Http
activity.SetTag("url.full", request.RequestUri.ToString());

// In OpenTelemetry.Instrumentation.AspNetCore
activity.SetTag("url.query", httpContext.Request.QueryString.Value);

Patched Code (1.8.1+):

The patched code introduces a redaction mechanism that replaces query parameter values with a placeholder.

// In OpenTelemetry.Instrumentation.Http
var uri = request.RequestUri;
var redactedQuery = RedactQueryString(uri.Query);
activity.SetTag("url.full", $"{uri.GetLeftPart(UriPartial.Path)}{redactedQuery}");

// In OpenTelemetry.Instrumentation.AspNetCore
var queryString = httpContext.Request.QueryString.Value;
var redactedQuery = RedactQueryString(queryString);
activity.SetTag("url.query", redactedQuery);

// Redaction helper method
private static string RedactQueryString(string queryString)
{
    if (string.IsNullOrEmpty(queryString))
        return queryString;

    var queryParams = HttpUtility.ParseQueryString(queryString);
    var redactedParams = new StringBuilder();
    foreach (string key in queryParams)
    {
        if (redactedParams.Length > 0)
            redactedParams.Append("&");
        redactedParams.Append($"{key}=[REDACTED]");
    }
    return redactedParams.ToString();
}

Exploitation & Lab Setup

Red Team

Objective: Demonstrate the leakage of sensitive data from a vulnerable application.

Lab Setup:

1. Create a .NET 8 Web API project.
2. Add the vulnerable NuGet packages:

   <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.7.0" />
   <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.7.0" />
   

3. Configure OpenTelemetry to export traces to a local collector (e.g., Jaeger).
4. Create an endpoint that makes an outgoing HTTP request with a sensitive query parameter:

   [HttpGet("external")]
   public async Task<IActionResult> CallExternal()
   {
       using var httpClient = new HttpClient();
       var response = await httpClient.GetAsync("https://example.com/api?token=supersecret&user=admin");
       return Ok(await response.Content.ReadAsStringAsync());
   }
   

5. Access the endpoint and observe the trace in Jaeger. The url.full attribute will contain the full URL with the token and user.

Exploitation: An attacker who can observe the telemetry data (e.g., through a compromised telemetry backend or network sniffing) can extract sensitive information from the query strings.

Blue Team

Objective: Detect and prevent the exploitation of this vulnerability.

Detection:

1. Network Monitoring: Monitor for outbound connections to telemetry backends (e.g., Jaeger, Zipkin, Azure Monitor) that contain URLs with sensitive query parameters.
2. Log Analysis: Review application logs for any instances of url.full or url.query attributes containing sensitive data.
3. Vulnerability Scanning: Use a software composition analysis (SCA) tool to identify the use of vulnerable versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore.

Prevention:

1. Patch: Upgrade to version 1.8.1 or later of the affected packages.
2. Configuration: If upgrading is not immediately possible, consider disabling the capture of url.full and url.query attributes via OpenTelemetry configuration.
3. Telemetry Backend Security: Ensure that telemetry backends are properly secured with access controls and encryption in transit and at rest.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Outbound HTTP/HTTPS requests to telemetry backends (e.g., jaeger-collector:14268, zipkin:9411) containing URLs with query strings.
  • Telemetry data payloads containing url.full or url.query attributes with sensitive data.
• Application Logs:
  • Log entries containing url.full or url.query with values like ?token=, ?password=, ?api_key=, etc.
• File System:
  • Project files (*.csproj) referencing OpenTelemetry.Instrumentation.Http or OpenTelemetry.Instrumentation.AspNetCore with version < 1.8.1.

Detection Engineering

YARA Rule

rule CVE_2024_32028_OpenTelemetry_Query_Leak {
    meta:
        description = "Detects potential leakage of sensitive data in OpenTelemetry query strings"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-32028"
    strings:
        $url_full = "url.full"
        $url_query = "url.query"
        $sensitive_param = /[?&](token|password|secret|api_key|access_key|session_id)=[^&\s]+/i
    condition:
        any of ($url_full, $url_query) and $sensitive_param
}

Sigma Rule

title: CVE-2024-32028 - OpenTelemetry Sensitive Data Leakage
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects OpenTelemetry spans containing sensitive data in query strings
author: Valters IT
date: 2024/01/01
tags:
    - cve.2024-32028
    - attack.t1190
logsource:
    category: application
    product: opentelemetry
detection:
    selection:
        attributes:
            - url.full
            - url.query
    keywords:
        - "?token="
        - "?password="
        - "?secret="
        - "?api_key="
        - "?access_key="
        - "?session_id="
    condition: selection and keywords
falsepositives:
    - Legitimate use of query parameters that are not sensitive
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32028 - OpenTelemetry Sensitive Data Leakage"; flow:to_server; content:"url.full"; http_client_body; content:"?token="; http_client_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-32028 - OpenTelemetry Sensitive Data Leakage"; flow:to_server; content:"url.query"; http_client_body; content:"?password="; http_client_body; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore to version 1.8.1 or later.

   dotnet add package OpenTelemetry.Instrumentation.Http --version 1.8.1
   dotnet add package OpenTelemetry.Instrumentation.AspNetCore --version 1.8.1
   

2. Configuration Change (if upgrade is delayed): Disable the capture of url.full and url.query attributes.

   builder.Services.AddOpenTelemetryTracing(builder =>
   {
       builder.AddAspNetCoreInstrumentation(options =>
       {
           options.RecordException = false;
           // Disable capturing query string
           options.Enrich = (activity, eventName, rawObject) =>
           {
               if (eventName == "OnStartActivity")
               {
                   activity.SetTag("url.query", null);
               }
           };
       });
       builder.AddHttpClientInstrumentation(options =>
       {
           options.Enrich = (activity, eventName, rawObject) =>
           {
               if (eventName == "OnStartActivity")
               {
                   activity.SetTag("url.full", null);
               }
           };
       });
   });
   

3. Long-Term: Implement a data loss prevention (DLP) policy for telemetry data. Regularly review and sanitize telemetry attributes to ensure no sensitive information is leaked.

Valters IT