Elastic Elasticsearch

Elasticsearch Incorrect Authorization

Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Reachable Assertion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Elasticsearch Allocation of Resources Without Limits or Throttling

Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Elasticsearch Insertion of sensitive information in log file

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Elasticsearch Uncaught Exception

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Elasticsearch StackOverflow vulnerability