Summary
The OpenTelemetry Spring Boot configuration adapters evaluated certain map-valued configuration properties as Spring Expression Language expressions. The default evaluation context permits type references, method invocation, and constructor calls. An attacker-controlled value consumed by this path can execute arbitrary Java code with the application's process privileges.
In 2.29.0, the evaluator was in SpringConfigProperties.getMap(). One affected setting is otel.instrumentation.common.peer-service-mapping. The otel.resource.attributes property and the four OTLP exporter header properties used a separate parsing path and did not reach this evaluator.
Affected releases before 2.1.0-alpha contained the equivalent evaluator in SpringResourceConfigProperties.getMap(). In those releases, exploitation requires a registered ResourceProvider bean that consumes an attacker-controlled map-valued property through that adapter.
Impact
Exploitation requires control over an affected configuration value when the application consumes it. Relevant sources include application configuration files, environment variables, system properties, and remote configuration providers.
These properties are normally consumed during SDK or instrumentation initialization. Versions 2.22.0 through 2.29.0 cache each property lookup on first access. Changing an already-resolved property does not change the value used by that configuration instance. Earlier versions do not have this cache, and lazily initialized components may first consume affected properties after application startup.
Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the application process.
The CVSS 3.1 score is 6.7, Medium: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This assessment assumes administrative write access to local application configuration, but not existing arbitrary code-execution authority, and automatic consumption without another user's action. No concrete unauthenticated network attack path has been demonstrated in the report.
Patches
Upgrade to 2.30.0 or later of io.opentelemetry.instrumentation:opentelemetry-spring-boot-starter or io.opentelemetry.instrumentation:opentelemetry-spring-boot-autoconfigure.
The fix in #19113 removes explicit SpEL evaluation from SpringConfigProperties.getMap() and uses the OpenTelemetry SDK's comma-delimited key=value parser.
The legacy artifact io.opentelemetry.instrumentation:opentelemetry-spring-boot is discontinued. Replace it with opentelemetry-spring-boot-starter or opentelemetry-spring-boot-autoconfigure version 2.30.0 or later. No patched release exists under the legacy coordinate.
Workarounds
If upgrading is not immediately possible, restrict write access to configuration sources that can supply affected map properties to principals already trusted to execute code in the application. Include remote configuration services and runtime configuration-management interfaces.
These access controls do not remove the vulnerable evaluator.
Behavior change
Map properties parsed through the replaced SpEL path must use comma-delimited key=value syntax instead of SpEL map literals. For example, replace {key:'value'} with key=value.
Credits
Reported by @lucianjohnhouse.
lucianjohnhouse Reporter
Summary
The OpenTelemetry Spring Boot configuration adapters evaluated certain map-valued configuration properties as Spring Expression Language expressions. The default evaluation context permits type references, method invocation, and constructor calls. An attacker-controlled value consumed by this path can execute arbitrary Java code with the application's process privileges.
In 2.29.0, the evaluator was in
SpringConfigProperties.getMap(). One affected setting isotel.instrumentation.common.peer-service-mapping. Theotel.resource.attributesproperty and the four OTLP exporter header properties used a separate parsing path and did not reach this evaluator.Affected releases before 2.1.0-alpha contained the equivalent evaluator in
SpringResourceConfigProperties.getMap(). In those releases, exploitation requires a registeredResourceProviderbean that consumes an attacker-controlled map-valued property through that adapter.Impact
Exploitation requires control over an affected configuration value when the application consumes it. Relevant sources include application configuration files, environment variables, system properties, and remote configuration providers.
These properties are normally consumed during SDK or instrumentation initialization. Versions 2.22.0 through 2.29.0 cache each property lookup on first access. Changing an already-resolved property does not change the value used by that configuration instance. Earlier versions do not have this cache, and lazily initialized components may first consume affected properties after application startup.
Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the application process.
The CVSS 3.1 score is 6.7, Medium:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This assessment assumes administrative write access to local application configuration, but not existing arbitrary code-execution authority, and automatic consumption without another user's action. No concrete unauthenticated network attack path has been demonstrated in the report.Patches
Upgrade to 2.30.0 or later of
io.opentelemetry.instrumentation:opentelemetry-spring-boot-starterorio.opentelemetry.instrumentation:opentelemetry-spring-boot-autoconfigure.The fix in #19113 removes explicit SpEL evaluation from
SpringConfigProperties.getMap()and uses the OpenTelemetry SDK's comma-delimitedkey=valueparser.The legacy artifact
io.opentelemetry.instrumentation:opentelemetry-spring-bootis discontinued. Replace it withopentelemetry-spring-boot-starteroropentelemetry-spring-boot-autoconfigureversion 2.30.0 or later. No patched release exists under the legacy coordinate.Workarounds
If upgrading is not immediately possible, restrict write access to configuration sources that can supply affected map properties to principals already trusted to execute code in the application. Include remote configuration services and runtime configuration-management interfaces.
These access controls do not remove the vulnerable evaluator.
Behavior change
Map properties parsed through the replaced SpEL path must use comma-delimited
key=valuesyntax instead of SpEL map literals. For example, replace{key:'value'}withkey=value.Credits
Reported by @lucianjohnhouse.