PT-2023-19074 · Unknown+1 · Opensearch+1

Cehenkle · Published 2023-01-24 · Updated 2025-04-03 · CVE-2023-23612

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSearch versions 1.0.0 through 1.3.7 OpenSearch versions 2.0.0 through 2.4.1

Description OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names.

Recommendations Upgrade to OpenSearch 1.3.8 for versions 1.0.0 through 1.3.7. Upgrade to OpenSearch 2.5.0 for versions 2.0.0 through 2.4.1.

Exploit

Fix

Improper Privilege Management

Improper Authentication

Weakness Enumeration

CWE-269

CWE-287

Related Identifiers

BDU:2025-04295

CVE-2023-23612

GHSA-864V-6QJ7-62QJ

Affected Products

Opensearch

Red Os

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23612.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-23612 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04295 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-23612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23612 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-23612 · Security Note
• https://osv.dev/vulnerability/GHSA-864v-6qj7-62qj · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-23612 · Vendor Advisory
• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0 · Note
• https://github.com/opensearch-project/security · Note
• https://github.com/opensearch-project/security/security/advisories/GHSA-864v-6qj7-62qj · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-opensearch-cve-2023-23612-cve-2023-23613 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23612 · Note
• https://t.me/cibsecurity/56965 · Telegram Post