Skip to content
Fencer Intel
critical —

GHSA-h8w2-rv57-vc6f json

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

published 7mo ago modified 7mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: 1. Splunk Distribution of OpenTelemetry Java is attached as a Java agent (`-javaagent`) 2. An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service) 3. A gadget-chain-compatible library is present on the classpath

### Impact Arbitrary remote code execution with the privileges of the user running the instrumented JVM.

### Recommendation Upgrade to version 2.26.1 or later.

### Workarounds Set the following system property to disable the RMI integration:

``` -Dotel.instrumentation.rmi.enabled=false ```

### References [Advisory in OpenTelemetry Instrumentation for Java](https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7)

Patch / fix

  • maven com.splunk:splunk-otel-javaagent 2.26.1

Is GHSA-h8w2-rv57-vc6f in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
maven com.splunk:splunk-otel-javaagent
<2.26.1
2.26.1

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.