CVE-2023-31417
Description
A flaw was found in the Elasticsearch package. Elasticsearch filters out sensitive information and credentials before logging into the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. As a result, sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs.
Statement
The audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured. Hence, the impact is set to Moderate.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Please update the affected package as soon as possible.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.1 | 4.4 | 4.1 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | Low | High |
| Privileges Required | High | High | High |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | None | None | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
In order to successfully exploit this vulnerability audit logging would need to be turned on, which is turned off by default, such a feature is out of attackers control hence attack complexity has been set as high. Apart from that in order to make some of these API calls such as POST /_xpack/security/user/{username}, you would need higher privileges, or this attack won't work.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
