Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper parsing of W3C baggage headers, where the dd-trace-dotnet library did not enforce limits on the number of items or the byte-size of the header. This could be exploited by a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted HTTP request with a large baggage header.
The analysis of the patch that resolves this vulnerability in version 3.43.0 of dd-trace-dotnet reveals that the core of the issue is in the Datadog.Trace.Propagators.W3CBaggagePropagator.ParseHeader function. The patch modifies this function to accept and enforce maxBaggageItems and maxBaggageLength limits. The Datadog.Trace.Propagators.W3CBaggagePropagator.TryExtract function, which is responsible for extracting the trace context, was also updated to retrieve these limits from the tracer's settings and pass them to ParseHeader.
Therefore, during an exploit, a runtime profiler would show that the Datadog.Trace.Propagators.W3CBaggagePropagator.TryExtract function is called, which in turn calls the Datadog.Trace.Propagators.W3CBaggagePropagator.ParseHeader function. The ParseHeader function is where the unbounded resource consumption occurs in the vulnerable versions. Both functions are critical indicators of the vulnerability being triggered.
Datadog.Trace.Propagators.W3CBaggagePropagator.ParseHeadertracer/src/Datadog.Trace/Propagators/W3CBaggagePropagator.cs
Datadog.Trace.Propagators.W3CBaggagePropagator.TryExtracttracer/src/Datadog.Trace/Propagators/W3CBaggagePropagator.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Datadog.Trace | nuget | < 3.43.0 | 3.43.0 |
| Datadog.Trace.OpenTracing | nuget | < 3.43.0 | 3.43.0 |