PT-2023-30151 · Elastic · Fleet Server

Published 2023-10-25 · Updated 2023-11-03 · CVE-2023-46667

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fleet Server versions 8.10.0 through 8.10.2

Description An issue was discovered where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively, a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.

Recommendations For Fleet Server versions 8.10.0 through 8.10.2, consider disabling the logging of Agent enrolment tokens until a patch is available. Restrict access to the Fleet Server’s log file to minimize the risk of exploitation. Avoid using the affected versions until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-46667

Affected Products

Fleet Server

References · 7

• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46667 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46667 · Vendor Advisory
• https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 · Note
• https://t.me/cibsecurity/72935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1717411916530713066 · Twitter Post
• https://t.me/latest_high_impact_cve/51 · Telegram Post