CVE-2024-23444

What it actually does

The elasticsearch-certutil CLI tool writes the private key generated during CSR creation to disk in plaintext, ignoring the --pass flag intended to encrypt it.

Why it matters to the business

Organizations using the tool may have private keys exposed on disk, increasing risk of unauthorized decryption of TLS traffic or access to protected Elasticsearch data if storage is later compromised.

How an attack unfolds

An attacker with access to the filesystem where the certutil tool runs can retrieve the unencrypted private key file left behind after an administrator invokes the csr option, even when --pass was supplied.

How to fix it

Upgrade elasticsearch to the version containing commit 09df99393193b2c53d92899662a8b8b3c55b45cd or later; after upgrade, regenerate any keys previously created with the affected certutil command and ensure they are properly encrypted.

How to confirm the fix worked

Confirm the elasticsearch version includes the referenced commit; re-run the certutil csr command with --pass and verify the resulting key file is encrypted (e.g., begins with a PKCS#8 encrypted header).

Typical attack path

1. Administrator runs elasticsearch-certutil csr with --pass to generate a new key and CSR.
2. Tool stores the private key file unencrypted on disk despite the encryption flag.
3. Attacker obtains local or remote filesystem access and locates the plaintext key file.
4. Attacker uses the recovered private key to decrypt TLS sessions or impersonate the Elasticsearch node.

How to detect it

Search filesystem audit logs and process execution history for invocations of elasticsearch-certutil with the csr option; inspect directories where keys are written for files lacking encryption headers.

What your security team should do

• Immediately upgrade all Elasticsearch instances to the fixed commit.
• Audit systems for any keys previously generated with the csr option and replace them.
• Restrict filesystem access to directories used by elasticsearch-certutil.
• Monitor for new private-key files created by the tool and verify encryption status.