CVE-2024-45043

Executive Summary

CVE-2024-45043 is a critical authentication bypass vulnerability in the OpenTelemetry Collector's awsfirehosereceiver module (alpha stage). The module is designed to ingest AWS Kinesis Data Firehose delivery stream messages and parse records based on a configured record type. The vulnerability allows unauthenticated remote attackers to send arbitrary metrics to the collector, even when the receiver is configured to require an access key via the X-Amz-Firehose-Access-Key header. This bypass occurs because the receiver accepts requests with no key at all, effectively nullifying the authentication mechanism. The impact is limited to unauthorized metric injection, which could be used to hide malicious activity by polluting monitoring data. There is no risk of data exfiltration. The vulnerability affects all users of the alpha awsfirehosereceiver module from version v0.49.0 up to (but not including) v0.108.0. The fix was introduced in PR #34847 and released with v0.108.0. No workarounds exist; upgrading is mandatory.

Supply Chain & Package Security

This vulnerability affects the OpenTelemetry Collector Contrib distribution, which is a Go-based project. The awsfirehosereceiver module is an alpha component, meaning it is not yet stable and may have incomplete security hardening. Users who include this module in custom builds or use the Contrib distribution are at risk. The supply chain risk is moderate: an attacker who can inject malicious metrics could potentially corrupt monitoring data, leading to false alarms or masking of real attacks. However, the module does not handle sensitive data, so exfiltration is not a concern. The fix is available in v0.108.0, and all users should upgrade immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required; the attacker simply sends an HTTP request without the access key.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – An attacker can inject arbitrary metrics, potentially corrupting monitoring data.
• Availability Impact: None (A:N) – The service remains available.

Threat Level: Medium. The vulnerability is easy to exploit (no auth required) and could be used to hide malicious activity by injecting fake metrics. However, it does not lead to data theft or service disruption.

Deep Dive & Mechanics

The awsfirehosereceiver module is designed to receive HTTP requests from AWS Kinesis Data Firehose. Firehose sends requests with a header X-Amz-Firehose-Access-Key containing a pre-shared key. The receiver can be configured to require this key for authentication. The vulnerability lies in the authentication logic: when the key is configured, the receiver still accepts requests that do not include the header at all. This means an attacker can send a request without any key and have it processed as valid.

The root cause is a missing check for the presence of the header. The code likely checks if the header value matches the configured key, but if the header is absent, the check is skipped or defaults to allowing the request. This is a classic authentication bypass due to incomplete validation.

The impact is that an attacker can inject arbitrary metrics into the OpenTelemetry pipeline. These metrics could be crafted to appear legitimate (e.g., low CPU usage) to hide a real attack, or to trigger false alerts. Since the receiver is often exposed to the public internet (Firehose does not support private endpoints), the attack surface is significant.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func (r *awsFirehoseReceiver) authenticate(r *http.Request) bool {
    key := r.Header.Get("X-Amz-Firehose-Access-Key")
    if key == "" {
        // BUG: Missing authentication when header is absent
        return true
    }
    return key == r.config.AccessKey
}

Patched Code (simplified):

func (r *awsFirehoseReceiver) authenticate(r *http.Request) bool {
    key := r.Header.Get("X-Amz-Firehose-Access-Key")
    if key == "" {
        // FIX: Reject requests without the header
        return false
    }
    return key == r.config.AccessKey
}

The fix adds a check for an empty header and returns false, denying the request. This ensures that only requests with a valid key are accepted.

Exploitation & Lab Setup

Red Team

Objective: Inject arbitrary metrics into an OpenTelemetry Collector configured with awsfirehosereceiver.

Prerequisites:

• Target OpenTelemetry Collector with awsfirehosereceiver enabled and configured to require an access key.
• Network access to the receiver endpoint (typically HTTP on port 8080 or similar).

Exploitation Steps:

1. Identify the endpoint: Scan for OpenTelemetry Collector instances. The receiver typically listens on /v1/metrics or similar. Use Shodan dorks: X-Amz-Firehose-Access-Key or awsfirehosereceiver.

2. Craft a malicious request: Send a POST request without the X-Amz-Firehose-Access-Key header. The body should contain a valid Firehose record format (e.g., CloudWatch metrics).

   Example using curl:

   curl -X POST http://target:8080/v1/metrics \
     -H "Content-Type: application/json" \
     -d '{
       "requestId": "12345",
       "timestamp": 1700000000000,
       "records": [
         {
           "data": "ewogICAgIm1ldHJpYyI6ICJ0ZXN0X21ldHJpYyIsCiAgICAidmFsdWUiOiAxMDAKfQ=="
         }
       ]
     }'
   

   The data field is base64-encoded JSON representing a metric. For example, the above decodes to:

   {
       "metric": "test_metric",
       "value": 100
   }
   

3. Verify injection: Check the OpenTelemetry Collector's output (e.g., logs or downstream systems) to see if the metric appears.

Note: No public exploit code exists, but the above demonstrates the bypass.

Blue Team

Detection and Response:

1. Monitor for missing headers: Alert on any HTTP requests to the awsfirehosereceiver endpoint that lack the X-Amz-Firehose-Access-Key header.

2. Rate limiting: Implement rate limiting on the receiver endpoint to reduce the impact of injection attacks.

3. Anomaly detection: Monitor metrics for unexpected patterns, such as sudden spikes or unusual metric names.

4. Network segmentation: If possible, restrict access to the receiver endpoint to only known Firehose IP ranges (though Firehose does not provide static IPs, consider using a VPN or private link).

5. Upgrade: Immediately upgrade to OpenTelemetry Collector Contrib v0.108.0 or later.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to the awsfirehosereceiver endpoint (e.g., /v1/metrics) without the X-Amz-Firehose-Access-Key header.
• Logs: OpenTelemetry Collector logs showing successful processing of requests without the access key.
• Metrics: Unexpected or anomalous metrics in the OpenTelemetry pipeline, such as metrics with names not matching expected patterns.

Detection Engineering

YARA Rule

rule CVE_2024_45043_AuthBypass {
    meta:
        description = "Detects HTTP requests to OpenTelemetry awsfirehosereceiver without access key"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45043"
    strings:
        $header_missing = "X-Amz-Firehose-Access-Key" nocase
        $path = "/v1/metrics" nocase
    condition:
        $path and not $header_missing
}

Sigma Rule

title: CVE-2024-45043 OpenTelemetry awsfirehosereceiver Auth Bypass
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to OpenTelemetry awsfirehosereceiver without the required access key header
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: opentelemetry
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/metrics'
    filter:
        cs-headers: 'X-Amz-Firehose-Access-Key:*'
    condition: selection and not filter
falsepositives:
    - Legitimate requests from AWS Firehose (should have the header)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45043 OpenTelemetry awsfirehosereceiver Auth Bypass"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/metrics"; http.header_names; content:!"X-Amz-Firehose-Access-Key"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update OpenTelemetry Collector Contrib to v0.108.0 or later. This is the only complete fix.
2. Workaround: None available. The vulnerability cannot be mitigated without patching.

Long-term Measures:

• Network controls: If possible, restrict access to the receiver endpoint using firewall rules or a reverse proxy that validates the X-Amz-Firehose-Access-Key header before forwarding.
• Monitoring: Implement the detection rules above to identify exploitation attempts.
• Vendor communication: Monitor OpenTelemetry security advisories for future updates.

Patch Details: The fix is in PR #34847, which adds a check for the presence of the X-Amz-Firehose-Access-Key header. Upgrade to v0.108.0.

Valters IT
Securing your digital frontier