Cloudanix VulnDB

CVE-2023-46673

High · 7.5

CVSS

7.5

EPSS

0.8%

Published

Nov 22, 2023

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Attackers can crash parts of a search system by sending specially crafted instructions, interrupting data access for users and applications.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Malformed scripts in the ingest pipeline script processor cause an Elasticsearch node to crash when the Simulate Pipeline API is invoked.

Why it matters to the business

Disrupts availability of search and data processing services, leading to potential downtime for applications dependent on Elasticsearch clusters; impacts organizations using affected versions across the ecosystem including downstream Keycloak deployments.

How an attack unfolds

An attacker submits a crafted request containing a malformed script within an ingest pipeline definition to the Simulate Pipeline API, triggering an unhandled condition that crashes the target node.

How to fix it

Upgrade elastic/elasticsearch to the fixed commit c63272efed16b5a1c25f3ce500715b7fddf9a9fb and org.keycloak/keycloak-services to version 24.0.3 or later; apply patches promptly given the public availability of the vulnerability for over two years.

How to confirm the fix worked

Confirm running versions match or exceed the fixed releases; test the Simulate Pipeline API with known-good and edge-case scripts to verify stability under load.

Typical attack path

  1. Locate an exposed Elasticsearch instance with the Simulate Pipeline API reachable over the network
  2. Construct a pipeline definition containing a malformed script
  3. Issue a POST request to the Simulate Pipeline API endpoint
  4. Observe node crash and resulting denial of service

How to detect it

Inspect Elasticsearch logs for script processor failures and node crashes correlated with Simulate Pipeline API requests; review access logs for repeated or anomalous calls to the simulate endpoint.

  • script processor crash
  • Simulate Pipeline API node failure
  • ingest pipeline malformed script error

What your security team should do

  • Prioritize upgrade of all affected Elasticsearch and Keycloak instances to the specified fixed versions
  • Restrict network access to the Simulate Pipeline API to trusted sources only
  • Implement monitoring for API abuse and node stability metrics

The record

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.elasticsearch:elasticsearch 7.0.0 7.17.14
Maven org.elasticsearch:elasticsearch 8.0.0 8.10.3
Bitnami elasticsearch 7.0.0 7.17.14
Ubuntu:16.04:LTS elasticsearch 0 No fix
Ubuntu:Pro:16.04:LTS elasticsearch 0 No fix
maven org.elasticsearch/elasticsearch 7.0.0 7.17.14
maven org.elasticsearch/elasticsearch 8.0.0 8.10.3

Related vulnerabilities