CVE-2024-52981

What it actually does

The vulnerability allows an attacker to trigger a stack overflow by submitting a Well-Known Text (WKT) string containing deeply nested GeometryCollection objects, leading to excessive recursion in the parsing logic.

Why it matters to the business

This can cause the Elasticsearch service to crash or become unresponsive, disrupting search and indexing operations for dependent applications.

How an attack unfolds

An attacker crafts a malicious WKT geometry string with excessive nesting of GeometryCollection objects and submits it through an API endpoint that processes geometry data, causing the parser to recurse too deeply and overflow the stack.

How to fix it

Upgrade Elasticsearch to the fixed version in commit 253e8544a65ad44581194068936f2a5d57c2c051 or later.

How to confirm the fix worked

Verify the installed version is updated and test parsing with nested geometries to ensure no crash.

Typical attack path

1. Identify an Elasticsearch instance accepting WKT input
2. Craft a deeply nested GeometryCollection WKT string
3. Submit the payload via relevant API
4. Observe service crash or DoS

How to detect it

Examine application logs for stack overflow errors or unusually large/complex WKT strings in requests.

What your security team should do

• Apply the fix immediately
• Monitor for unusual geometry inputs
• Implement input validation if possible