Listen to this Post
The `OpenTelemetry.Resources.Host` NuGet package provides resource detectors for host information within the OpenTelemetry observability framework. On macOS, the `host.id` resource attribute detector is implemented by invoking two external system utilities: `sh` and ioreg. Prior to version 1.16.0-beta.2, the detector launched these executables using their bare names rather than absolute paths. This means the operating system resolves them by searching through directories listed in the `PATH` environment variable, a mechanism that is inherently untrusted because `PATH` can be influenced by users or the environment.
This reliance on relative path resolution introduces an untrusted search path vulnerability (CWE-426). A local attacker who is less privileged than the host application can exploit this flaw if they can manipulate the `PATH` variable or write to a directory that appears earlier in the search order than the legitimate system directories such as `/usr/bin` or /bin. When the vulnerable OpenTelemetry component attempts to execute `sh` or ioreg, it inadvertently runs an attacker-controlled binary instead of the legitimate system utility.
The impact is severe: the attacker gains code execution in the security context of the application process. Because OpenTelemetry agents often run with elevated permissions to collect telemetry data from various sources, successful exploitation can lead to local privilege escalation, potentially granting the attacker full control over the host machine and access to sensitive observability data. The vulnerability was fixed by executing `ioreg` directly using its absolute path. This issue affects only macOS hosts; Linux and Windows implementations are unaffected. No workarounds are known, and upgrading to version `1.16.0-beta.2` or later is required to mitigate the risk.
DailyCVE Form:
Platform: macOS
Version: < 1.16.0-beta.2
Vulnerability : Untrusted Search Path
Severity: High
date: 2026-09-08
Prediction: 2026-09-15
What Undercode Say:
Check current PATH environment variable
echo $PATH
Locate all instances of ioreg and sh in PATH
which -a ioreg
which -a sh
Verify the absolute path of the legitimate system binaries
ls -la /usr/bin/ioreg
ls -la /bin/sh
List installed OpenTelemetry.Resources.Host package version (if using .NET CLI)
dotnet list package --include-transitive | grep OpenTelemetry.Resources.Host
Inspect directories in PATH for user-writable permissions
IFS=':' read -ra ADDR <<< "$PATH"
for dir in "${ADDR[@]}"; do
if [ -w "$dir" ]; then
echo "Writable directory in PATH: $dir"
fi
done
Exploit: (Educational Purposes!)
Educational demonstration only. Do not use on systems without explicit permission. Create a malicious directory at the front of PATH mkdir -p /tmp/evil cd /tmp/evil Create a fake ioreg executable that runs arbitrary code cat > ioreg << 'EOF' !/bin/bash echo "[!] Malicious ioreg executed with privileges of the OpenTelemetry process." Attacker payload would be placed here EOF chmod +x ioreg Prepend the malicious directory to PATH export PATH="/tmp/evil:$PATH" When the vulnerable OpenTelemetry host detector runs, it will execute the attacker-controlled ioreg instead of the legitimate system binary.
Protection: from this CVE
- Upgrade `OpenTelemetry.Resources.Host` to version `1.16.0-beta.2` or later, which invokes `ioreg` using its absolute path.
- Ensure the `PATH` environment variable does not contain user-writable directories that precede system directories when running OpenTelemetry-instrumented applications.
- Restrict the ability of lower-privileged users to influence the environment of higher-privileged services.
- Apply the principle of least privilege to application processes and their environments.
- Monitor for unexpected modifications to `PATH` or the presence of malicious binaries named `ioreg` or `sh` in user-controlled directories.
Impact:
- Local arbitrary code execution within the context of the vulnerable application.
- Privilege escalation if the OpenTelemetry agent runs with elevated permissions.
- Potential full compromise of the host machine.
- Unauthorized access to sensitive observability data and other processes running under the same user context.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
