PT-2022-23078 · Unknown · Opensearch Security+2
Peternied
·
Published
2022-08-12
·
Updated
2022-08-16
·
CVE-2022-35980
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenSearch Security versions 2.0.0.0 through 2.1.0.0
Description
The issue concerns an information disclosure vulnerability in OpenSearch Security, a plugin for OpenSearch that provides encryption, authentication, and authorization. When an OpenSearch cluster is configured with advanced access control features such as document level security (DLS), field level security (FLS), and/or field masking, requests will not be filtered if the query's search pattern matches an aliased index. Since OpenSearch Dashboards creates an alias to
.kibana by default, filters with the index pattern of * to restrict access to documents or fields will not be applied, allowing requests to access sensitive information despite access restrictions.Recommendations
For versions 2.0.0.0 and 2.1.0.0, update to OpenSearch Security 2.2.0.0, which is compatible with OpenSearch 2.2.0 and contains the fix for this issue.
As a temporary workaround, consider restricting access to the
.kibana alias to minimize the risk of exploitation.
Avoid using the index pattern of * in filters to restrict access to documents or fields until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opensearch
Opensearch Dashboards
Opensearch Security