Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-45142

CVE-2023-45142:
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-45142
GHSA ID
GHSA-rcjv-mgp8-qvmr
EPSS Score
0.75486%
CWE
CWE-770
Published
10/16/2023
Updated
2/19/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpgo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulgo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgingo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmuxgo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelechogo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacarongo< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptracego< 0.44.00.44.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability lies in the generation of metrics with unbound cardinality, specifically from 'http.method' and 'http.user_agent' attributes. The analysis focused on identifying functions that either generated these problematic attributes or consumed them for metrics recording prior to the patch.

  1. The otelhttp.NewHandler function is identified as it's the entry point for using the vulnerable otelhttp middleware, as highlighted in the vulnerability description.
  2. The otelhttp.(*middleware).serveHTTP function is identified as it's the core request handler in otelhttp that, before the patch, used semconvutil.HTTPServerRequest (which in turn calls (*httpConv).ServerRequest) to get attributes for metrics. The patch changed this to use a new, safer semconvutil.HTTPServerRequestMetrics.
  3. The (*httpConv).ServerRequest function (present in internal/semconvutil/httpconv.go across multiple affected instrumentation packages) is identified as the generator of the high-cardinality attributes. The vulnerability description explicitly mentions httpconv.ServerRequest. The fix involved creating a new function (*httpConv).ServerRequestMetrics that omits problematic attributes (like http.user_agent) and sanitizes others (like http.method via methodMetric) for metric purposes. The calling handlers were then updated to use this new function for metrics.

The evidence is drawn from the vulnerability description and the changes in the provided commit information, particularly the introduction of ServerRequestMetrics and methodMetric functions, and the modification of serveHTTP to use the new metrics function. The functions listed are those that would be active in the runtime path when the vulnerability is triggered by processing HTTP requests and generating metrics from them.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry T*is **n*l*r wr*pp*r *ttps://*it*u*.*om/op*n-t*l*m*try/op*nt*l*m*try-*o-*ontri*/*lo*/****************************************/instrum*nt*tion/n*t/*ttp/ot*l*ttp/**n*l*r.*o#L**-L** out o* t** *ox ***s l***ls - `*ttp.us*r_***nt` - `*ttp.m*

Reasoning

T** vuln*r**ility li*s in t** **n*r*tion o* m*tri*s wit* un*oun* **r*in*lity, sp**i*i**lly *rom '*ttp.m*t*o*' *n* '*ttp.us*r_***nt' *ttri*ut*s. T** *n*lysis *o*us** on i**nti*yin* *un*tions t**t *it**r **n*r*t** t**s* pro*l*m*ti* *ttri*ut*s or *onsum