Cloudanix VulnDB

CVE-2023-49921

Medium · 5.2

CVSS

5.2

EPSS

0.4%

Published

Jul 26, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A search monitoring feature can write private stored information into ordinary log files when a certain detailed logging option is turned on.

Exploitation
Adjacent Network
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Watcher search input logs full search query results at DEBUG level, causing raw Elasticsearch document contents to be written to log files when the specified hierarchical loggers are enabled.

Why it matters to the business

Sensitive data stored in Elasticsearch may be exposed in log files, increasing risk of unauthorized access to confidential information if logs are not strictly protected.

How an attack unfolds

An attacker with access to application logs (via log aggregation systems, file system access, or compromised monitoring) retrieves raw document contents that were printed when a Watcher search input executed under DEBUG logging.

How to fix it

Upgrade to Elasticsearch 8.11.2, 7.17.16, or the commit 76013fa76dcbf144c886990c6290715f5dc2ae20; alternatively avoid setting DEBUG logging on the watcher input loggers.

How to confirm the fix worked

Confirm the running version matches a fixed release, review logging configuration to ensure watcher input loggers are not set to DEBUG, and inspect sample logs for absence of raw document output.

Typical attack path

  1. Configure DEBUG or finer logging for org.elasticsearch.xpack.watcher.input.search or parent loggers
  2. Define a Watcher that uses the search input
  3. Trigger the watch to execute the search
  4. Access log files or centralized logging to read the printed document contents

How to detect it

Search application and audit logs for entries containing watcher input search results, presence of the logger names org.elasticsearch.xpack.watcher.input.search or org.elasticsearch.xpack.watcher, or raw document JSON appearing in DEBUG-level log lines.

  • org.elasticsearch.xpack.watcher.input.search
  • org.elasticsearch.xpack.watcher.input
  • org.elasticsearch.xpack.watcher

What your security team should do

  • Apply the fixed versions immediately on all Watcher deployments
  • Audit logging configurations and restrict watcher-related loggers to INFO or higher
  • Review existing log archives for any prior exposure of sensitive documents

The record

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.elasticsearch:elasticsearch 0 7.17.16
Maven org.elasticsearch:elasticsearch 8.0.0 8.11.2
Bitnami elasticsearch 7.0.0 7.17.16
Ubuntu:16.04:LTS elasticsearch 0 No fix
Ubuntu:Pro:16.04:LTS elasticsearch 0 No fix
maven org.elasticsearch/elasticsearch 8.0.0 8.11.2

Related vulnerabilities