GHSA-v8pv-4842-x354: High severity nuget/OpenTelemetry.Resources.Host vulnerability
Summary
The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variable.
A local attacker who is less privileged than the host application, and who can influence PATH or write to a directory that appears in PATH ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation.
Details
The implementation of the host detector macOS has always invoked ioreg and sh via their bare names since it was implemented by open-telemetry/opentelemetry-dotnet-contrib#1631.
The vulnerability was fixed by open-telemetry/opentelemetry-dotnet-contrib#4760 which executes ioreg directly using its absolute path.
Impact
Applications running on macOS that use the OpenTelemetry.Resources.Host detector when an attacker who is less privileged than the application process can influence PATH or write to a PATH directory that precedes the system directories (e.g. a higher-privileged service with a user-writable directory in its search path, or a process inheriting an attacker-influenced environment). The attacker gains code execution in the application's security context through an attacker-controlled ioreg executable.
Mitigation
This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected.
Workarounds
None known.
References
- GHSA-9h8m-3fm2-qjrq - open-telemetry/opentelemetry-dotnet-contrib#4760 - CWE-426
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/OpenTelemetry.Resources.Hostto a version that resolves this vulnerability.Fixed in 1.16.0-beta.2 - Upgrade
Upgrade
OpenTelemetry.Resources.Host (NuGet)to a version that resolves this vulnerability.Patch open-telemetry/opentelemetry-dotnet-contrib#4760 - Compensating control
On macOS, ensure `PATH` cannot be influenced by less-privileged attackers (e.g., remove/avoid user-writable directories from `PATH` ahead of system directories) to prevent resolution of attacker-controlled `sh`/`ioreg` binaries by bare name.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications running on macOS that use the OpenTelemetry.Resources.Host package and its host.id resource attribute detector are exposed. The issue depends on execution environments where PATH can be influenced or contains an attacker-writable directory before the system directories.
What does an attacker need to exploit this?
The attacker must already have local access at a lower privilege level than the application and be able to influence PATH or write a malicious executable named sh or ioreg into a directory searched by PATH ahead of the legitimate system locations. Successful exploitation runs that binary in the application's security context.
What is the practical impact of successful exploitation?
An attacker can obtain arbitrary code execution in the context of the affected application. If the application runs with greater privileges than the attacker, this can result in local privilege escalation.
What can be done if an update cannot be applied immediately?
Ensure the application runs with a trusted PATH that does not include attacker-writable directories before system directories. Prevent less-privileged users from modifying PATH for the application or writing executables into directories it searches.
How can I determine whether an application is affected?
Check whether it runs on macOS, references OpenTelemetry.Resources.Host, and enables or invokes the host.id resource attribute detector. Also review the PATH inherited by the application for attacker-writable or user-controlled directories that precede the system executable directories.