CVE-2024-12539

What it actually does

Improper authorization on certain queries bypasses Document Level Security checks in Elasticsearch, allowing access to documents outside assigned roles.

Why it matters to the business

Sensitive data may be exposed to unauthorized users, increasing breach risk and compliance costs; low exploit likelihood and no known ransomware use reduce urgency but patching remains needed for older Ubuntu Firefox and Thunderbird deployments.

How an attack unfolds

An attacker with limited Elasticsearch access crafts queries that evade DLS enforcement to retrieve restricted documents; no named threat actors or campaigns are associated.

How to fix it

Upgrade affected packages to the listed fixed versions: firefox (Ubuntu:14.04:LTS) to 45.0+build2-0ubuntu0.14.04.1 and thunderbird (Ubuntu:14.04:LTS) to 1:38.7.2+build1-0ubuntu0.14.04.1; apply vendor patches immediately given the six-hundred-plus days since disclosure.

How to confirm the fix worked

Confirm package versions match the fixed releases above and test that role-restricted queries now correctly enforce Document Level Security.

Typical attack path

1. Gain access to an Elasticsearch cluster with a low-privilege role
2. Identify queries involving document-level security
3. Craft and submit malformed queries to bypass authorization
4. Retrieve and exfiltrate unauthorized documents

How to detect it

Review Elasticsearch query logs for unusual patterns that return documents outside expected role scopes; no ransomware or APT indicators are known.

What your security team should do

• Prioritize upgrades on any remaining Ubuntu 14.04 systems running the listed packages
• Review and tighten Elasticsearch role mappings and query logging
• Monitor EPSS trend for any increase above current low levels