PT-2024-2502 · Elastic · Elasticsearch

Ismisepaul · Published 2024-03-29 · Updated 2024-05-14 · CVE-2024-23449

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 8.4.0 through 8.11.0

Description The issue is related to an error in handling exceptions in the Elasticsearch search system's API implementation. It can be exploited by a remote attacker using a specially crafted PDF file, leading to a denial of service. Specifically, when an encrypted PDF is passed to an attachment processor through the REST API, the Elasticsearch ingest node attempting to parse the PDF file will crash. This issue does not affect password-protected PDF files or unencrypted PDF files.

Recommendations For Elasticsearch versions 8.4.0 through 8.11.0, update to version 8.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API endpoint that processes attachments to minimize the risk of exploitation. Avoid using the attachment processor for encrypted PDF files until the issue is resolved.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2024-02483

BIT-ELASTICSEARCH-2024-23449

CVE-2024-23449

GHSA-PW39-F3M5-CXFC

Affected Products

Elasticsearch

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-23449 · Security Note
• https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23449 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2024-23449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02483 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-23449 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23449 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pw39-f3m5-cxfc · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note
• https://github.com/elastic/elasticsearch/commit/a59180459a3cb30b71399d778943cab4ac2191c4 · Note
• https://github.com/elastic/elasticsearch/commit/f9bf18a716613473fc1cb96c838874e1f9f6ba22 · Note
• https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458/1 · Note
• https://twitter.com/CVEnew/status/1773672654215520406 · Twitter Post