CVE-2024-23451
Medium · 4.4CVSS
4.4
EPSS
0.5%
Published
Mar 27, 2024
CISA due date
—
Cloudanix analysis
A security setting meant to protect data shared between Elasticsearch clusters could be bypassed, allowing someone who already has limited access to read private information from those clusters using a special internal connection method.
- Exploitation
- Remote Authenticated
- Attacker needs
- High Privilege
- Complexity
- High
- Impact
- Data Exposure
- Component
- Application
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect authorization in the beta Remote Cluster Security API key model permits a holder of a valid remote cluster API key to bypass index-level access controls and read arbitrary documents when requests are issued over the custom transport protocol with explicit index, shard, and document identifiers.
Why it matters to the business
Organizations using the beta remote cluster feature face limited but real risk of unauthorized cross-cluster data exposure; the issue is confined to the transport protocol and requires a pre-existing valid key, reducing blast radius yet still necessitating prompt upgrade before wider adoption.
How an attack unfolds
An attacker first obtains a legitimate API key configured for a remote cluster that has Remote Cluster Security enabled, then crafts a request using the internal transport protocol that directly specifies the target index ID, shard ID, and document ID, thereby reading documents from any index without triggering REST API authorization checks.
How to fix it
Upgrade Elasticsearch to version 8.13.0 or later (commit 09df99393193b2c53d92899662a8b8b3c55b45cd). If the beta Remote Cluster Security feature cannot be upgraded immediately, disable the feature or restrict API key issuance for remote clusters.
How to confirm the fix worked
Confirm the running version is 8.13.0 or newer; attempt to reproduce the bypass using the transport protocol with a valid remote-cluster API key against an index the key should not access; review cluster logs for transport-protocol requests that reference arbitrary indices.
Typical attack path
- Obtain a valid API key for a remote cluster with Remote Cluster Security enabled
- Discover or guess target index, shard, and document identifiers on the remote cluster
- Issue a request over the Elasticsearch custom transport protocol supplying those identifiers
- Retrieve arbitrary document contents bypassing intended authorization
How to detect it
Search Elasticsearch transport-protocol logs and audit trails for API-key authenticated requests that specify explicit index, shard, and document IDs; correlate with remote-cluster configuration events; look for post-8.10.0 activity involving the beta Remote Cluster Security feature.
What your security team should do
- Upgrade all Elasticsearch nodes to 8.13.0 or later as soon as possible
- Audit and revoke any API keys issued for remote clusters until the upgrade is complete
- Disable the beta Remote Cluster Security feature if it is not required
- Add monitoring for custom transport protocol usage that references unexpected indices
The record
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 8.10.0 | 8.13.0 |
| Bitnami | elasticsearch | 8.10.0 | 8.13.0 |
| Chainguard | elasticsearch-8 | 0 | 8.13.1-r0 |
| Chainguard | elasticsearch-8-bitnami | 0 | 8.13.1-r0 |
| Chainguard | elasticsearch-8-config | 0 | 8.13.1-r0 |
| Chainguard | elasticsearch-8-iamguarded | 0 | 8.13.1-r0 |
| Chainguard | elasticsearch-config | 0 | 8.13.1-r0 |
| Ubuntu:16.04:LTS | elasticsearch | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | elasticsearch | 0 | No fix |
| maven | org.elasticsearch/elasticsearch | 8.10.0 | 8.13.0 |
Related vulnerabilities
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects org.elasticsearch:elasticsearch
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects org.elasticsearch:elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects org.elasticsearch:elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects org.elasticsearch:elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23450 A flaw was discovered in Elasticsearch, where processing a document in a deeply nested… Also affects org.elasticsearch:elasticsearch
- CVE-2023-46673 It was identified that malformed scripts used in the script processor of an Ingest… Also affects org.elasticsearch:elasticsearch