Security issues

• Logstash is configured to log in JSON format, which is not the default logging format.
• Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.

Users should upgrade to Elasticsearch version 7.17.13 and 8.9.0 and higher. 

Users should upgrade to Elastic Cloud Enterprise version 2.13.4 and 3.6.1

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled.

The _xpack/security APIs have been deprecated in Elasticsearch 7.x and were entirely removed in 8.0.0 and later. The only way for a client to use them in Elasticsearch 8.0.0 and later is to provide the Accept: application/json; compatible-with=7 header. Elasticsearch official clients do not use these deprecated APIs.

The list of affected, deprecated APIs, is the following

POST /_xpack/security/user/{username}

PUT /_xpack/security/user/{username}

PUT /_xpack/security/user/{username}/_password

POST /_xpack/security/user/{username}/_password

PUT /_xpack/security/user/_password

POST /_xpack/security/user/_password

POST /_xpack/security/oauth2/token

DELETE /_xpack/security/oauth2/token

POST /_xpack/security/saml/authenticate

Affected Versions:

Elasticsearch versions from 7.0.0 up to 7.17.12 and from 8.0.0 up to 8.9.1

ESA-2022-07

2022-06-06

CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832

2021-12-10

See ESA-2021-31, Apache Log4j2

Elasticsearch, Logstash 7.16.3 and 6.8.23 are released, which upgrade log4j to 2.17.1.

ESA-2021-25

CVE-2021-37937

2021-09-01

An issue was found with how API keys are created with the fleet-server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised fleet-server service account could escalate themselves to a super-user.

Users should upgrade to Elasticsearch version 7.14.1

ESA-2021-18

CVE-2021-22147

2021-08-03

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

Users who are using document or field level security with searchable snapshots should upgrade to version 7.14.0

ESA-2021-16

CVE-2021-22145

2021-07-20

A memory disclosure vulnerability was identified in Elasticsearch’s error reporting. A user with

the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that

would result in an error message returned containing previously used portions of a data buffer.

This buffer could contain sensitive information such as Elasticsearch documents or

authentication details.

Thanks to Eric Howard (Bell Canada) for reporting this issue.

Affected users should update their version of Elasticsearch to 7.13.4. There is no known

workaround for this issue.

ESA-2021-15

CVE-2021-22144

2021-07-07

An uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.

Users should update their version of Elasticsearch to 7.13.3 or 6.8.17

_{The following mitigations have been implemented in Elastic Cloud:}

• _{We have purged sensitive data that was logged from our monitoring environment.}
• _{We have deployed and are currently fortifying a redaction solution so that no new instances of sensitive information are logged in our monitoring environment and in customer’s monitoring clusters.}

_{For Elastic Cloud customers with self-managed monitoring clusters, affected logs should be reviewed for any potential sensitive data and if deemed necessary, follow up actions such as purging sensitive data from logs and rotating any potentially exposed credentials should be performed.}

_{As additional mitigation, Elastic Cloud customers are advised to upgrade to 8.11.1.}

_{Users on affected versions of Kibana in self-managed, ECE, or ECK, should upgrade to Kibana 8.11.1.}

_{Please see ESA-2023-25 for more details.}

_{On Sept 11, 2023, Google Chrome announced CVE-2023-4863, described as “Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page”. Kibana includes a bundled version of headless Chromium that is only used for Kibana’s reporting capabilities and which is affected by this vulnerability. An exploit for Kibana has not been identified, however as a resolution, the bundled version of Chromium is updated in this release.} 

_{This issue affects on-premises Kibana installations on host Operating Systems where Chromium sandbox is disabled(only CentOS, Debian, RHEL).}

_{This issue affects Kibana instances running using the Kibana Docker image when the Chromium sandbox is explicitly disabled as suggested by the documentation. Further exploitation such as container escape is prevented by seccomp-bpf.}

_{This issue affects Kibana instances running on Elastic Cloud but the RCE is limited within the Kibana Docker container. Further exploitation such as container escape is prevented by seccomp-bpf and AppArmor profiles.}

_{This issue affects Kibana instances running on Elastic Cloud Enterprise (ECE) but the RCE is limited within the Kibana Docker container. Further exploitation such as container escape is prevented by seccomp-bpf and AppArmor profiles.}

_{This issue affects Kibana instances running on Elastic Cloud on Kubernetes (ECK) but the RCE is limited within the Kibana Docker container. Further exploitation such as container escape can be prevented by seccomp-bpf when configured and supported (Kubernetes v1.19 and later).}

_{Users should upgrade to version 8.10.3 or 7.17.14.}

_{If you are unable to upgrade, you can disable Kibana reporting functionality completely in the kibana.yml file with the following setting:} 

 _{xpack.reporting.enabled: false} 

CVE-2022-23713

2022-06-30

For Stack Monitoring users that cannot upgrade to the fixed versions, we recommend removing the monitoring settings, monitoring.ui.elasticsearch.*, from the configuration of the remote Kibana instance until the remote Kibana instance is upgraded. These users can still safely access the Stack Monitoring UI through the Kibana instance that is directly attached to the monitoring Elasticsearch cluster.

Affected Versions:  For self-managed deployments the issue impacts versions 7.15.0, 7.15.1, and 7.15.2. For Elastic Cloud Services the issue impacts versions 7.15.0 through 7.17.0, and 8.0.0.
CVSSv3: 5.4 (Medium) - AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

As mitigation, users on affected versions can avoid granting users All access to the Index Pattern Management and Saved Object Management features if they should not be able to otherwise create/modify index patterns. Note: index patterns are called data views starting in 8.0.

Affected Versions: Versions 7.7.0 through 7.17.0, and 8.0.0
CVSSv3: 4.3 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

As mitigation, users on affected versions can avoid granting users Read access to the Uptime feature if they should not be able to otherwise create/modify alerts, and avoid using the built-in Viewer role.

Affected Versions: Versions 7.5.1 through 7.16.3
CVSSv3: 8.1 (High)- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Versions: Versions 7.8.0 through 7.15.1
CVSSv3: 4.1 (Medium) - AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Affected Versions: 7.9.0 through 7.15.1
CVSSv3: 3.1 (Low) - AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

ESA-2021-21

CVE-2021-22150

2021-09-01

It was discovered that a user with fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the kibana server.

Users should upgrade to Kibana version 7.14.1

ESA-2021-22

CVE-2021-22151

2021-09-01

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

Thanks to Luat Nguyen of CyberJutsu for reporting this issue.

Users should upgrade to Kibana version 7.14.1

ESA-2021-23

CVE-2021-37936

2021-09-01

It was discovered that kibana was not sanitizing document fields containing html snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

Users can set “doc_table:highlight” to “false” in the Kibana Advanced Settings. Users who do not wish to do this, and are currently on version 7.14.0 should upgrade to version 7.14.1.

ESA-2021-24

CVE-2021-3672CVE-2021-22931CVE-2021-22940CVE-2021-22939

2021-09-01

Node.js version 14.17.3 is affected by several security vulnerabilities: CVE-2021-3672, CVE-2021-22931, CVE-2021-22940, and CVE-2021-22939. We do not believe an attacker can exploit these against Kibana, but we are upgrading Node.js out of an abundance of caution. Kibana 7.14.1 upgrades Node.js to version 14.17.5 to resolve these issues.

Users should upgrade to Kibana version 7.14.1

Thank you to Dominic Couture for this finding.

Users running version 6.7.0 or later have a reduced risk from this XSS vulnerability when Kibana is configured to use the [default Content Security Policy](https://www.elastic.co/guide/en/kibana/current/settings.html) with a modern browser. While the CSP prevents XSS, it does not mitigate the underlying HTML injection vulnerability.

This flaw is mitigated by default in all Elastic Cloud Kibana versions.

Upgrade Assistant can be disabled by setting the following options in Kibana:
Kibana versions 6.7.0 and 6.7.1 can set ‘upgrade_assistant.enabled: false’ in the kibana.yml file
Kibana versions starting with 6.7.2 can set ‘xpack.upgrade_assistant.enabled: false’ in the kibana.yml file

This flaw is mitigated by default in all Elastic Cloud Kibana versions.

CVE-2019-15604 describes a Denial of Service (DoS) flaw in the TLS handling code of Node.js. Successful exploitation of this flaw could result in Kibana crashing.

CVE-2019-15606 and CVE-2019-15605 describe flaws in how Node.js handles malformed HTTP headers. These malformed headers could result in a HTTP request smuggling attack when Kibana is running behind a proxy vulnerable to HTTP request smuggling attacks.

This update upgrades Node.js to version 10.19.0, which is not vulnerable to these issues.

Please note that Kibana has Content Security Policy (CSP) enabled by default since versions 6.7.0 and 7.0.0. Most browsers supported by Kibana honor the CSP settings. CSP prevents attackers from executing arbitrary JavaScript using this flaw, however an attacker can still inject arbitrary HTML into the page. The ‘csp.strict: true’ can be set in kibana.yml to disallow browsers that do not enforce CSP rules.

Thanks to Eran Vaknin and Rotem Reiss, Security Researchers, for reporting this issue.

The Code application in Kibana is a beta feature and disabled by default at this time. If you do not have ‘xpack.code.ui.enabled: true’ in your kibana.yml configuration file you are not affected by this issue.

Users unable to upgrade that have enabled the Code application in Kibana can disable it by setting ‘xpack.code.ui.enabled: false’ in kibana.yml.

Kibana now includes a timelion.graphiteUrls option that allows administrator to whitelist valid graphite URLs in the kibana.yml file.

Thanks to Braden Hollembaek of Salesforce for reporting this issue.

A denial of service vulnerability was discovered in ECE that could lead to  the ECE Admin API server becoming unavailable if a maliciously crafted JWT is supplied. This is due to the use of a transitive dependency json-smart which parses nested arrays in an unsafe way. Deployments that run on ECE are unaffected.

The dependency has been updated which resolves the issue in versions 2.13.3 and 3.3.0

2022-09-27

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.

Severity: CVSSv3.1: 8.7 (High) - AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Users should upgrade to Elastic Cloud Enterprise 3.1.1 or later. Note that by default, only users with a Platform admin role have access to the Logging and Monitoring cluster.

ESA-2022-10

2022-08-24

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster.

Severity: CVSSv3.1: 8.5 (High) - AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Users should upgrade to Elastic Cloud Enterprise 3.4.0. Note that by default, only users with a Platform admin role have access to the Logging and Monitoring cluster and the audit logs.

ESA-2021-17

CVE-2021-22146

2021-07-20

Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

Affected users should apply the stack pack. There is no known workaround.

Affected Versions: Workplace Search versions through 7.15.2
CVSSv3: 6.8 (Medium) - AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

ESA-2021-20

CVE-2021-22149

2021-08-03

A flaw in Elastic App Search was discovered where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Users should upgrade to version 7.14.0

ESA-2021-19

CVE-2021-22148

2021-08-03

A flaw in Elastic App Search was discovered where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines.

Users should upgrade to version 7.14.0

Thank you to Dominic Couture for this finding

When configuring Enterprise Search to connect to a Confluence Server, Jira Server, Confluence Cloud, or Jira Cloud the TLS certificate will not be properly verified by the oauth-ruby library. This could result in a man in the middle style attack against Enterprise Search connecting to an Atlassian service.

Thanks to Matt Peel of Silverstripe for reporting this vulnerability.