CVE-2024-32028: 
C# vulnerability analysis and mitigation

OpenTelemetry dotnet is a dotnet telemetry framework that contains a vulnerability in versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore prior to 1.8.1. The vulnerability relates to how these packages handle query string parameters in HTTP requests, where sensitive information could potentially be exposed in telemetry data. The issue was discovered and disclosed on April 12, 2024, and affects the url.full attribute/tag for outgoing HTTP requests and url.query attribute/tag for incoming HTTP requests (GHSA Advisory).

The vulnerability occurs because the affected versions pass through raw query string parameters as-is when writing telemetry data. This applies to both outgoing HTTP requests (via url.full attribute) and incoming HTTP requests (via url.query attribute). These attributes are defined by the Semantic Conventions for HTTP Spans. The CVSS v3.1 score is 4.1 (Medium) with vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (GHSA Advisory).

The vulnerability may lead to sensitive information being leaked into telemetry backends, including End User Identifiable Information (EUII), credentials, and other sensitive data. This could potentially cause privacy and security incidents depending on the applications being instrumented (GHSA Advisory).

The vulnerability requires an attacker to have access to the telemetry backend where the data is being stored. The attack complexity is considered low, requiring low privileges and no user interaction, though the attack vector is adjacent rather than network-accessible (GHSA Advisory).

The vulnerability has been fixed in version 1.8.1 of both OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore. The fix implements redaction by default for all values detected in query strings. For example, a query string like ?key1=value1&key2=value2 will now be recorded as ?key1=Redacted&key2=Redacted. Users are strongly advised to upgrade to version 1.8.1 or later (GHSA Advisory).