CVE-2024-55886

Executive Summary

CVE-2024-55886 is a critical authentication bypass vulnerability in the OpenTelemetry Logs source of OpenSearch Data Prepper, affecting versions 2.1.0 through 2.10.1. The flaw allows unauthorized users to ingest OpenTelemetry Logs data when custom authentication plugins are used that implement the getHttpAuthenticationService() method instead of getAuthenticationInterceptor(). The built-in http_basic authentication provider is not affected. This vulnerability has a CVSS score of 6.9 (Medium) and could lead to unauthorized data injection, potentially corrupting log analytics pipelines.

Supply Chain & Package Security

This vulnerability affects the OpenSearch Data Prepper component, which is distributed as a Java application via Maven Central and Docker images. Organizations using custom authentication plugins in their Data Prepper deployments are at risk. The fix is available in version 2.10.2, and users are strongly advised to upgrade immediately. For those unable to upgrade, using the built-in http_basic authentication provider or deploying an authentication proxy in front of Data Prepper instances are recommended mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the low complexity of exploitation and the potential for unauthorized data injection. However, the impact is limited to integrity and confidentiality of log data, with no availability impact.

Deep Dive & Mechanics

The vulnerability resides in the OpenTelemetry Logs source of OpenSearch Data Prepper. Data Prepper uses a plugin-based authentication system where developers can implement custom GrpcAuthenticationProvider interfaces. The flaw occurs when a custom authentication plugin implements the getHttpAuthenticationService() method instead of the required getAuthenticationInterceptor() method. In such cases, the authentication logic is not invoked, allowing unauthenticated requests to be processed.

The root cause is a missing check in the OpenTelemetry Logs source that fails to enforce authentication when the custom plugin provides an HTTP authentication service rather than a gRPC interceptor. This allows attackers to send OpenTelemetry log data without any credentials, bypassing the intended security controls.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.10.2):

// In OpenTelemetryLogsSource.java
GrpcAuthenticationProvider authProvider = ...;
if (authProvider.getHttpAuthenticationService() != null) {
    // Authentication is skipped because the code only checks for interceptor
    // No authentication is performed
}

Patched Code (2.10.2+):

// In OpenTelemetryLogsSource.java
GrpcAuthenticationProvider authProvider = ...;
if (authProvider.getHttpAuthenticationService() != null) {
    // Authentication is now enforced
    authProvider.getHttpAuthenticationService().authenticate(request);
}

The fix ensures that when a custom authentication plugin provides an HTTP authentication service, it is properly invoked to authenticate incoming requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenSearch Data Prepper instance (version 2.1.0 to 2.10.1) with a custom authentication plugin that implements getHttpAuthenticationService().
• Network access to the OpenTelemetry Logs source port (typically 21890).

Exploitation Steps:

1. Identify the target Data Prepper instance and its OpenTelemetry Logs source endpoint.
2. Craft an OpenTelemetry log request without any authentication headers.
3. Send the request using a tool like grpcurl or a custom gRPC client.

Example using grpcurl:

grpcurl -plaintext -d '{"resourceLogs": [{"resource": {}, "scopeLogs": [{"logRecords": [{"body": {"stringValue": "test log"}}]}]}]}' <target-ip>:21890 opentelemetry.proto.collector.logs.v1.LogsService/Export

Expected Outcome: The log data is accepted and processed without authentication.

Blue Team

Detection:

• Monitor for unauthorized log ingestion attempts from unexpected IP addresses.
• Check Data Prepper logs for authentication failures or missing authentication entries.
• Use network monitoring to detect gRPC traffic to the OpenTelemetry Logs source port.

Mitigation:

• Upgrade to Data Prepper 2.10.2 or later.
• If upgrade is not possible, switch to the built-in http_basic authentication provider.
• Deploy an authentication proxy (e.g., Envoy, NGINX) in front of Data Prepper instances.

Indicators of Compromise (IOCs)

• Network: gRPC connections to port 21890 (default OpenTelemetry Logs source port) without authentication headers.
• Logs: Data Prepper logs showing successful log ingestion without corresponding authentication entries.
• System: Unusual log entries in OpenSearch that do not match expected data sources.

Detection Engineering

YARA Rule

rule CVE_2024_55886_DataPrepper_AuthBypass {
    meta:
        description = "Detects vulnerable OpenSearch Data Prepper versions with custom auth plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-55886"
    strings:
        $vuln_class = "GrpcAuthenticationProvider"
        $vuln_method = "getHttpAuthenticationService"
    condition:
        $vuln_class and $vuln_method
}

Sigma Rule

title: CVE-2024-55886 - OpenSearch Data Prepper Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized log ingestion attempts against vulnerable OpenSearch Data Prepper instances
author: Valters IT
date: 2025-04-17
logsource:
    category: application
    product: opensearch
detection:
    selection:
        event: "Log ingestion"
        authentication: "none"
    condition: selection
falsepositives:
    - Legitimate unauthenticated log sources (if configured)
level: high

Suricata Rule

alert tcp any any -> any 21890 (msg:"CVE-2024-55886 - OpenSearch Data Prepper Auth Bypass"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"/opentelemetry.proto.collector.logs.v1.LogsService/Export"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenSearch Data Prepper to version 2.10.2 or later.
2. If upgrade is not possible, switch to the built-in http_basic authentication provider.
3. Deploy an authentication proxy (e.g., Envoy, NGINX) in front of Data Prepper instances.

Long-term Measures:

• Review all custom authentication plugins to ensure they implement getAuthenticationInterceptor() instead of getHttpAuthenticationService().
• Implement network segmentation to restrict access to Data Prepper instances.
• Enable logging and monitoring for all authentication events.
• Regularly update Data Prepper and other OpenSearch components.

Workarounds:

• Use the built-in http_basic authentication provider.
• Add an authentication proxy that validates credentials before forwarding requests to Data Prepper.

Valters IT