GHSA-RFXF-MF63-CPQV

Vulnerability from github – Published: 2024-08-13 18:59 – Updated: 2024-08-13 21:57
VLAI?
Summary
open-telemetry has an Observable Timing Discrepancy
Details

Summary

The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens.

Details

https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/9128a9258fe1fee36f198f97b1e3371fc7b77a93/extension/bearertokenauthextension/bearertokenauth.go#L189-L196

For background on the type of vulnerability, see https://ropesec.com/articles/timing-attacks/.

Impact

This impacts anyone using the bearertokenauth server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline.

Fix

The observable timing vulnerability was fixed by @axw in v0.107.0 (PR https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516) by using constant-time comparison.

Workarounds

  • upgrade to v0.107.0 or above, or, if you're unable to upgrade at this time,
  • don't expose the receiver using bearertokenauth to network segments accessible by potential attackers, or
  • change the receiver to use a different authentication extension instead, or
  • disable the receiver relying on bearertokenauth
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.80.0"
            },
            {
              "fixed": "0.107.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-42368"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-13T18:59:32Z",
    "nvd_published_at": "2024-08-13T20:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe bearertokenauth extension\u0027s server authenticator performs a simple, non-constant time string comparison of the received \u0026 configured bearer tokens.\n\n### Details\n\nhttps://github.com/open-telemetry/opentelemetry-collector-contrib/blob/9128a9258fe1fee36f198f97b1e3371fc7b77a93/extension/bearertokenauthextension/bearertokenauth.go#L189-L196\n\nFor background on the type of vulnerability, see https://ropesec.com/articles/timing-attacks/.\n\n### Impact\n\nThis impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector\u0027s telemetry pipeline.\n\n### Fix\n\nThe observable timing vulnerability was fixed by @axw in v0.107.0 (PR https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516) by using constant-time comparison.\n\n### Workarounds\n\n- upgrade to v0.107.0 or above, or, if you\u0027re unable to upgrade at this time,\n- don\u0027t expose the receiver using `bearertokenauth` to network segments accessible by potential attackers, or\n- change the receiver to use a different authentication extension instead, or\n- disable the receiver relying on `bearertokenauth`",
  "id": "GHSA-rfxf-mf63-cpqv",
  "modified": "2024-08-13T21:57:31Z",
  "published": "2024-08-13T18:59:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-rfxf-mf63-cpqv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42368"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/c9bd3eff0bb357d9c812a0d8defd3b09db95699a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-collector-contrib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "open-telemetry has an Observable Timing Discrepancy"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.