CVE-2024-23445
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Jun 12, 2024
CISA due date
—
Cloudanix analysis
A flaw in how Elasticsearch handles certain cross-cluster keys could let users see more search results than they are supposed to when clusters are linked for replication and searching.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Network Service
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
A cross-cluster API key that both restricts search results via query or field_security and grants replication on the same index bypasses those search restrictions during cross-cluster search operations, allowing unauthorized documents and terms to be returned.
Why it matters to the business
Organizations using the GA cross-cluster API key security model may expose sensitive index data across clusters to users who should only have limited search visibility, increasing risk of data leakage in multi-cluster deployments.
How an attack unfolds
An attacker obtains or compromises a cross-cluster API key configured with both replication and restricted search privileges on an index, then performs cross-cluster search operations that ignore the query and field_security constraints, retrieving full result sets.
How to fix it
Upgrade Elasticsearch to the fixed version containing commit 8d96bbe3bf5fed931f3119733895458eab75dca9. Review and rotate any cross-cluster API keys that combine replication and search restrictions on the same index.
How to confirm the fix worked
Confirm the running version includes the referenced commit; test cross-cluster search behavior with a key that has both replication and restricted search to verify restrictions are now enforced.
Typical attack path
- Identify or obtain a cross-cluster API key that grants replication and search on the same remote index
- Issue cross-cluster search requests using that key against the affected index
- Observe that search restrictions are not applied and full document or term results are returned
How to detect it
Review Elasticsearch audit logs and search request logs for cross-cluster API key usage patterns involving both replication and search on the same indices; look for unexpected full result sets returned to restricted keys.
What your security team should do
- Prioritize upgrade of all clusters using the cross-cluster API key model to the fixed commit
- Audit existing cross-cluster API keys for combined replication and search privileges on identical indices
- Monitor for new cross-cluster search activity after upgrade to confirm expected restriction behavior
The record
It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross cluster search operations and search results may include documents and terms that should not be returned. This issue only affects the API key based security model for remote clusters https://www.elastic.co/guide/en/elasticsearch/reference/8.14/remote-clusters.html#remote-clusters-security-models that was previously a beta feature and is released as GA with 8.14.0
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | elasticsearch | 8.10.0 | 8.14.0 |
| Chainguard | elasticsearch-8 | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-8-bitnami | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-8-config | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-8-iamguarded | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-config | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8 | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-bitnami | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-config | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-2 | 0 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-3 | 0 | 8.14.1-r0 |
| Chainguard | sonarqube | 0 | 25.10.0.114319-r0 |
| Chainguard | sonarqube-10 | 0 | 25.3.0.104237-r0 |
| Chainguard | sonarqube-10-docker-compat | 0 | 25.3.0.104237-r0 |
| Chainguard | sonarqube-10-scripts | 0 | 25.3.0.104237-r0 |
| Chainguard | sonarqube-docker-compat | 0 | 25.10.0.114319-r0 |
| Chainguard | sonarqube-scripts | 0 | 25.10.0.114319-r0 |
| Ubuntu:16.04:LTS | elasticsearch | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | elasticsearch | 0 | No fix |
| Wolfi | sonarqube | 0 | 25.10.0.114319-r0 |
| Wolfi | sonarqube-10 | 0 | 25.3.0.104237-r0 |
| Wolfi | sonarqube-10-docker-compat | 0 | 25.3.0.104237-r0 |
| Wolfi | sonarqube-10-scripts | 0 | 25.3.0.104237-r0 |
| Wolfi | sonarqube-docker-compat | 0 | 25.10.0.114319-r0 |
| Wolfi | sonarqube-scripts | 0 | 25.10.0.114319-r0 |
Related vulnerabilities
- CVE-2025-68384 Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User… Also affects elasticsearch
- CVE-2025-68390 Elasticsearch privileged authenticated users can cause DoS through Excessive Resource… Also affects elasticsearch
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects elasticsearch
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects elasticsearch