CVE-2024-23451: Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model
First published: Wed Mar 27 2024(Updated: )
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.
Credit: bressers@elastic.co bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.elasticsearch:elasticsearch | >=8.10.0<8.13.0 | 8.13.0 |
| Elastic Elasticsearch | >=8.10.0<8.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23451?
CVE-2024-23451 is classified as a high severity vulnerability due to its potential to allow unauthorized access through the incorrect authorization in the API key security model.
How do I fix CVE-2024-23451?
To fix CVE-2024-23451, you should upgrade Elasticsearch to version 8.13.0 or later, which resolves the incorrect authorization issue.
What versions of Elasticsearch are affected by CVE-2024-23451?
CVE-2024-23451 affects Elasticsearch versions from 8.10.0 up to but not including 8.13.0.
What type of vulnerability is CVE-2024-23451?
CVE-2024-23451 is an Incorrect Authorization vulnerability that affects the Remote Cluster Security feature in Elasticsearch.
Who is affected by CVE-2024-23451?
Organizations using Elasticsearch versions 8.10.0 through 8.12.0 that implement the remote cluster feature with API key-based security are at risk from CVE-2024-23451.
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r3hx-qfh5-r9m7
- alias/CVE-2024-23451
- agent/software-canonical-lookup
- agent/references
- agent/softwarecombine
- agent/severity
- agent/event
- agent/author
- collector/nvd-cve
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- package-manager/maven
- vendor/elastic
- canonical/elastic elasticsearch
- version/elastic elasticsearch/8.10.0