Open_basedir Circumvention in datadog/dd-trace
Summary
GHSA-qvgg-r6rq-vwfx: datadog/dd-trace Circumvents open_basedir INI directive. Affects datadog/dd-trace versions >= 0.30.0, < 0.30.2. Fixed in 0.30.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
datadog/dd-trace is a package available on Packagist that provides distributed tracing for PHP applications. It allows developers to instrument their code and collect performance metrics and traces. However, versions 0.30.0 to 0.30.2 of dd-trace are affected by a security and stability issue related to the open_basedir INI directive.
Vulnerability Detail
The vulnerability in datadog/dd-trace allows the ddtrace.request_init_hook to bypass the open_basedir INI directive. This can lead to potential security risks as it allows access to files and directories outside the specified open_basedir path. Attackers could exploit this vulnerability to read, modify, or execute arbitrary files on the system, potentially compromising the application and its environment. The issue has been addressed in PR #579, which introduces a sandboxing mechanism to isolate the request init hook and ensure it adheres to open_basedir restrictions.
How To Fix
Minimum fixed version
0.30.2
This is the first release that contains the fix.
composer require datadog/dd-trace:0.30.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to update to the latest version of datadog/dd-trace as soon as possible.
Conclusion
datadog/dd-trace versions 0.30.0 to 0.30.2 are affected by a vulnerability that allows the ddtrace.request_init_hook to bypass the open_basedir INI directive. This can lead to potential security risks and compromise the application's environment. It is crucial to update to version 0.30.2 or later to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for datadog/dd-trace →
FAQ
datadog/dd-trace is a package that provides distributed tracing for PHP applications. It allows developers to collect performance metrics and traces to monitor and optimize their applications.
The open_basedir INI directive is a security measure in PHP that restricts the files and directories that PHP can access. It helps prevent PHP scripts from accessing sensitive files outside the specified paths.
In the affected versions of datadog/dd-trace, the ddtrace.request_init_hook was not bound by the open_basedir directive, allowing it to access files outside the specified paths.
The vulnerability could allow attackers to read, modify, or execute arbitrary files on the system, potentially compromising the application and its environment. It is important to update to the fixed version to mitigate these risks.
To update datadog/dd-trace to the fixed version (0.30.2 or later), you can use Composer by running the command: composer require datadog/dd-trace:^0.30.2
