CVE-2024-23451: Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23451?
CVE-2024-23451 is classified as a high severity vulnerability due to its potential to allow unauthorized access through the incorrect authorization in the API key security model.
How do I fix CVE-2024-23451?
To fix CVE-2024-23451, you should upgrade Elasticsearch to version 8.13.0 or later, which resolves the incorrect authorization issue.
What versions of Elasticsearch are affected by CVE-2024-23451?
CVE-2024-23451 affects Elasticsearch versions from 8.10.0 up to but not including 8.13.0.
What type of vulnerability is CVE-2024-23451?
CVE-2024-23451 is an Incorrect Authorization vulnerability that affects the Remote Cluster Security feature in Elasticsearch.
Who is affected by CVE-2024-23451?
Organizations using Elasticsearch versions 8.10.0 through 8.12.0 that implement the remote cluster feature with API key-based security are at risk from CVE-2024-23451.