# OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

OBI's privileged Java injector trusted target-process TMPDIR and used non-exclusive file creation, letting a local attacker overwrite arbitrary host files via path escape or symlink clobber.

- Payout: Research
- Severity: high
- Program: OpenTelemetry eBPF Instrumentation
- Found by: MrAlias
- Disclosed: 2026-04-17
- CVE: CVE-2026-41433
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8gmg-3w2q-65f4
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-8gmg-3w2q-65f4
- Tags: area:cloud domain:infra impact:dos impact:integrity impact:privesc kind:research platform:ghsa sev:high tech:go tech:linux technique:source-review vuln:path-traversal vuln:privilege-escalation

**Target:** Java agent injection staging logic (java_inject.go) in privileged OBI host agent
**Root cause:** dirOK() validated TMPDIR with filepath.Join(root, dir); an absolute dir discards root, so host paths pass validation. copyAgent() then wrote the JAR with O_WRONLY|O_CREATE|O_TRUNC, no O_EXCL/O_NOFOLLOW, allowing symlink clobbering.
**Steps:**
1. Start a Java process with `TMPDIR=/etc` or `TMPDIR=/proc/1/root/etc`.
2. Ensure OBI discovers the process and selects it for Java agent injection.
3. Wait for injector to stage the agent JAR; observe write of `obi-java-agent.jar` outside `/proc/<pid>/root`.
4. Symlink variant: start Java process with `TMPDIR=/tmp`, pre-create `/tmp/obi-java-agent.jar -> /path/to/target/file`.
5. Trigger injection; privileged injector opens symlink target with truncate semantics and overwrites it.
**How found:** Code review of the Java injection staging path: noticed dirOK used filepath.Join with /proc/<pid>/root, which drops root for absolute paths, and that copyAgent used non-exclusive truncating open semantics.
**Exploitation:** Local attacker controls a Java workload's environment. Setting TMPDIR to an absolute host path escapes the /proc/<pid>/root boundary; alternatively pre-placing a symlink at the predictable JAR destination in a writable temp dir causes the privileged OBI process to truncate/overwrite the symlink target.
**Escalation:** Overwriting files writable by the privileged OBI process can yield host integrity compromise, DoS, and possible local privilege escalation depending on overwritten targets.
**Insight:** When validating paths intended to be confined under /proc/<pid>/root, filepath.Join silently discards the root for absolute inputs — check for absolute-path bypass; and any privileged write into an attacker-influenced directory needs O_EXCL/O_NOFOLLOW to defeat symlink clobbering.

## Proof of concept (copied exactly from the original report)

**Symlink clobber at agent JAR destination**

```
/tmp/obi-java-agent.jar -> /path/to/target/file
```