GHSA-fc6f-cp96-6g5w: 
PHP vulnerability analysis and mitigation

Summary

The host resource detector in open-telemetry/sdk runs a helper program to read the machine ID on macOS, Windows and BSD. It runs that program through a shell, by name, so the shell looks it up on PATH. On Windows it also looks in the current directory. A program with the same name placed earlier in that search runs instead, as the user running PHP, and its output becomes host.id. The detector is enabled by default, and runs each time the SDK builds its default resource. With OTEL_PHP_AUTOLOAD_ENABLED=true that is once per request.

Affected

• macOS: affected. The detector runs ioreg and awk. Replacing either one is enough.
• Windows: affected. The detector runs powershell.exe. A file with that name in a directory on PATH, or in the working directory of the PHP process, runs instead.
• FreeBSD and other BSDs: affected only when /etc/hostid is missing or unreadable. The detector then runs which and kenv. A default FreeBSD install creates /etc/hostid at boot, so this mostly applies to jails and to read-only or diskless systems.

Not affected

• Linux. The detector reads /etc/machine-id and runs no program. This includes PHP in Docker on a macOS or Windows host, because the container runs Linux.
• Applications whose OTEL_PHP_DETECTORS lists detectors without host.
• Applications that use declarative configuration without host under resource.detection/development.detectors.
• Versions before 1.1.0.

Preconditions

The attacker needs to put a file in a directory that is searched before the system directory. Usually that is a directory on the PHP process's PATH. On Windows the process's working directory also counts. The attacker gains something only when PHP runs as a different, more privileged account than their own. An account that can already write to those directories as the PHP user can usually replace other programs or the application itself. This is mostly a risk for developer machines, shared build hosts and self-hosted CI runners, not production servers.

Patches

Fixed in <version>. The detector runs /usr/sbin/ioreg, /bin/kenv and %SystemRoot%\System32\reg.exe by absolute path, without a shell, as the semantic conventions require.

Workarounds

Set OTEL_PHP_DETECTORS to a list without host, for example OTEL_PHP_DETECTORS=process. With declarative configuration, leave host out of resource.detection/development.detectors.