PT-2017-18330 · Elastic · X-Pack Security

Published 2017-06-05 · Updated 2019-10-09 · CVE-2017-8438

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elastic X-Pack Security versions 5.0.0 to 5.4.0

Description The issue is related to a privilege escalation bug in the run as functionality. This bug affects the transitioning into a specified user in a run as request. If a role has been created using a template containing the user properties, the behavior of run as will be incorrect. Furthermore, if the specified run as user does not exist, the transition will not occur.

Recommendations For Elastic X-Pack Security versions 5.0.0 to 5.4.0, consider restricting the use of the run as functionality until a fix is available. As a temporary workaround, ensure that all roles are created without using templates that contain the user properties, and verify the existence of the run as user before attempting to transition.

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2017-8438

Affected Products

X-Pack Security

References · 5

• https://elastic.co/community/security · Vendor Advisory
• https://elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8438 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8438 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 · Vendor Advisory