PT-2024-2594 · Elastic · Elasticsearch

Published 2024-01-16 · Updated 2025-02-04 · CVE-2024-23451

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 8.10.0 through 8.12.x

Description The issue is related to an Incorrect Authorization problem in the API key based security model for Remote Cluster Security, which is currently in Beta. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster. The exploitation is possible only if the malicious user uses the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID, and the document ID. None of the Elasticsearch REST API endpoints are affected by this issue.

Recommendations For Elasticsearch versions 8.10.0 through 8.12.x, update to the latest Elasticsearch version immediately to resolve the issue. As a temporary workaround, consider restricting access to the Remote Cluster Security feature until the update is applied. Additionally, restrict the use of the Elasticsearch custom transport protocol to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-02657

BIT-ELASTICSEARCH-2024-23451

CVE-2024-23451

GHSA-R3HX-QFH5-R9M7

Affected Products

Elasticsearch

References · 15

• https://osv.dev/vulnerability/GHSA-r3hx-qfh5-r9m7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23451 · Vendor Advisory
• https://discuss.elastic.co/t/elasticsearch-8-13-0-security-update-esa-2024-07/356315 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23451 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23451 · Security Note
• https://bdu.fstec.ru/vul/2024-02657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23451 · Security Note
• https://ubuntu.com/security/CVE-2024-23451 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2024-23451 · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note
• https://t.me/cvenotify/74878 · Telegram Post
• https://twitter.com/CVEnew/status/1773096340555477246 · Twitter Post
• https://twitter.com/oktsec/status/1775297602658983957 · Twitter Post
• https://t.me/cvenotify/74933 · Telegram Post
• https://t.me/cvenotify/109850 · Telegram Post