CVE-2024-43709

What it actually does

The vulnerability allows an attacker to cause an OutOfMemoryError in Elasticsearch by submitting a specially crafted query that uses an SQL function, leading to uncontrolled resource allocation and a crash.

Why it matters to the business

Attackers can cause Elasticsearch instances to crash, resulting in temporary loss of search and data indexing capabilities, potentially disrupting dependent applications and services. No ransomware association or known exploitation in the wild.

How an attack unfolds

An attacker crafts a malicious SQL query leveraging specific functions to bypass resource limits in Elasticsearch, triggering excessive memory allocation until the service crashes due to OutOfMemoryError.

How to fix it

Upgrade Elasticsearch to the fixed commit 617f7b76c4ebcb5a7f1e70d409a99c437c896aea. Apply the patch as soon as possible to prevent denial of service conditions.

How to confirm the fix worked

Confirm the running Elasticsearch version includes commit 617f7b76c4ebcb5a7f1e70d409a99c437c896aea. Test with known triggering queries to ensure no OOM occurs and monitor memory usage under load.

Typical attack path

1. Identify publicly accessible Elasticsearch instance exposing SQL query capabilities
2. Craft and submit a specially crafted query using an SQL function designed to allocate unbounded resources
3. Trigger memory exhaustion resulting in OutOfMemoryError and service crash

How to detect it

Inspect Elasticsearch logs for OutOfMemoryError exceptions, sudden crashes, or restarts correlated with SQL queries; review query audit logs for unusual function usage patterns.

What your security team should do

• Immediately upgrade all Elasticsearch deployments to the fixed commit 617f7b76c4ebcb5a7f1e70d409a99c437c896aea
• Restrict SQL query access to trusted users and review query permissions
• Enable resource monitoring and alerting for memory usage anomalies