Executive Summary

The vulnerability exists in OpenTelemetry.Resources.Azure, specifically in versions 1.15.0-beta.1 and earlier. The AzureVmMetaDataRequestor class makes HTTP requests to the Azure VM instance metadata service and reads the entire response body into memory without any size limit.

An attacker who controls the configured endpoint or can intercept the traffic via a man-in-the-middle attack can send an arbitrarily large response. This causes unbounded heap allocation in the process consuming the response, which can lead to high memory usage, garbage collection delays, or an OutOfMemoryException that crashes the process.

The issue is fixed in version 1.15.1-beta.1 by streaming responses instead of buffering them fully in memory and ignoring responses larger than 4 MiB.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your application or service using the affected OpenTelemetry Azure resource detector to consume excessive memory when processing metadata responses.

The excessive memory consumption can lead to high transient memory pressure, delays due to garbage collection, or even an OutOfMemoryException that terminates the process unexpectedly.

Such crashes or performance degradation can disrupt service availability and reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the AzureVmMetaDataRequestor class in OpenTelemetry.Resources.Azure making HTTP requests to the Azure VM instance metadata service and reading the response body without size limits. Detection would involve identifying if your system is running OpenTelemetry.Resources.Azure version 1.15.0-beta.1 or earlier.

You can check the version of the OpenTelemetry.Resources.Azure package used in your .NET applications. Additionally, monitoring for unusually high memory usage or OutOfMemoryExceptions in processes using this package may indicate exploitation attempts.

Since the vulnerability is triggered by HTTP requests to the Azure VM instance metadata service, you can also monitor network traffic for large or abnormal responses from the metadata endpoint.

Specific commands to check the package version in a .NET project include:

• dotnet list package | findstr OpenTelemetry.Resources.Azure

To monitor memory usage or process crashes, use system monitoring tools appropriate for your environment (e.g., Task Manager, top, or performance counters).

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the Azure VM resource detector in OpenTelemetry.Resources.Azure to prevent it from making vulnerable HTTP requests.

Alternatively, implement network-level controls such as firewall rules to restrict access to the Azure VM instance metadata endpoint.

Use mutual TLS (mTLS) or a service mesh to prevent man-in-the-middle attacks on the metadata endpoint, which could be exploited to send arbitrarily large responses.

Finally, update OpenTelemetry.Resources.Azure to version 1.15.1-beta.1 or later, where the vulnerability is fixed by streaming responses and ignoring responses larger than 4 MiB.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0