PT-2019-18663 · Elastic · Elasticsearch

Published 2019-03-25 · Updated 2022-05-13 · CVE-2019-7611

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 5.6.15 Elasticsearch versions prior to 6.6.1

Description A permission issue was found when Field Level Security and Document Level Security are disabled and certain endpoints are used. If the elasticsearch.yml file has xpack.security.dls fls.enabled set to false, certain permission checks are skipped, potentially allowing an attacker to gain additional permissions against a restricted index. The issue arises when users perform actions involving the " aliases", " shrink", or " split" endpoints.

Recommendations For Elasticsearch versions prior to 5.6.15, update to version 5.6.15 or later to resolve the issue. For Elasticsearch versions prior to 6.6.1, update to version 6.6.1 or later to resolve the issue. As a temporary workaround, consider setting xpack.security.dls fls.enabled to true in the elasticsearch.yml file to enable Field Level Security and Document Level Security, and restrict access to the " aliases", " shrink", and " split" endpoints until a patch is applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2019-7611

GHSA-FJ32-6V7M-57PG

Affected Products

Elasticsearch

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-7611 · Security Note
• https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fj32-6v7m-57pg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7611 · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note