Elasticsearch ESA-2019-04

high Nessus Plugin ID 122973

Language:

Synopsis

The remote web server hosts a Java application that is vulnerable.

Description

A permission issue was found in Elasticsearch when Field Level Security and Document Level Security are disabled and the _aliases,
_shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name.
This could result in an attacker gaining additional permissions against a restricted index.

Solution

Users should upgrade to Elasticsearch version 5.6.15 or 6.6.1. Users unable to upgrade can change the xpack.security.dls_fls.enabled setting to true in their elasticsearch.yml file. The default setting for this option is true.

Plugin Details

Severity: High

ID: 122973

File Name: elasticsearch_esa_2019_04.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 3/20/2019

Updated: 10/30/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-7611

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:elasticsearch:elasticsearch

Required KB Items: installed_sw/Elasticsearch

Exploit Ease: No known exploits are available

Patch Publication Date: 2/19/2019

Vulnerability Publication Date: 2/19/2019

Reference Information

CVE: CVE-2019-7611

Detections

Analytics