OpenTelemetry OTLP/Zipkin Exporter Sensitive Credential Log Leakage Fix & PoC

Vulnerability Key Information Summary Vulnerability Overview Type: Information Disclosure (sensitive information appearing in internal logs) Description: The OTLP and Zipkin trace exporters logged endpoint configurations containing credentials (such as ) in internal logs, resulting in the leakage of sensitive information (e.g., ) to the log output. Remediation Objective: Prevent internal trace exporters from logging endpoint configurations to avoid sensitive information disclosure. Scope of Impact Affected Components: - (OTLP trace exporter) - (Zipkin exporter) Affected Versions: As indicated by changes in , involving dependency versions such as . Impact: When an exporter's endpoint configuration contains sensitive information (such as username/password), the method writes the full endpoint (including credentials) to the logs, causing information disclosure. Remediation 1. Refactor the method: - In / for and , modify the method so that when the endpoint contains sensitive information, it only logs non-sensitive fields (e.g., , ), avoiding the output of the full endpoint string. - Specific change: Replace with logging only the and fields to avoid directly outputting the endpoint containing credentials. 2. Add new test cases: - Add new tests in and to verify that when the endpoint contains sensitive information, the log output does not include the sensitive endpoint string. POC / Exploit Code 1. Test code in (verifying that sensitive endpoints are not leaked) 2. Test code in (verifying that sensitive endpoints are not leaked) 3. Fix for the method in (otlptrace) After Fix (inferred from diff): 4. Fix for the method in After Fix (inferred from diff): Summary The core of this vulnerability is that trace exporters leaked endpoint configurations containing credentials in logs. The remediation involves refactoring the method to avoid outputting the full endpoint string (containing username/password) in logs, logging only non-sensitive fields (such as , ), and verifying through new test cases that sensitive information no longer appears in the logs.

Goal Reached Thanks to every supporter — we hit 100%!

OpenTelemetry OTLP/Zipkin Exporter Sensitive Credential Log Leakage Fix & PoC

More from this source