PT-2024-4672 · Elastic · Elasticsearch
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Elasticsearch versions prior to 8.14.0
Description:
The issue is related to the implementation of the Elasticsearch search system's application programming interface, specifically with the cross-cluster API key. If a cross-cluster API key restricts search for a given index using the
query or the field security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross-cluster search operations. This may allow an attacker to disclose protected information. The issue only affects the API key-based security model for remote clusters, which was previously a beta feature and is released as GA with 8.14.0.Recommendations:
As a temporary workaround, consider restricting access to the cross-cluster API key until a patch is available.
For versions prior to 8.14.0, update to version 8.14.0 or later to resolve the issue.
Avoid using the
query or field security parameters in the cross-cluster API key until the issue is resolved.
Restrict access to the API key-based security model for remote clusters to minimize the risk of exploitation.Exploit
Fix
Improper Access Control
Insecure Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Elasticsearch