GHSA-r8cv-xvqm-4qj4: OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSearch SQL pluginto a version that resolves this vulnerability.Fixed in 2.19.6.0 - Upgrade
Upgrade
OpenSearch SQL pluginto a version that resolves this vulnerability.Fixed in 3.7.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the OpenSearch SQL plugin in the 2.x line from 2.8.0.0 through versions before 2.19.6.0, or the 3.x line before 3.7.0.0. The vulnerable request path is the plugins/sql endpoint.
What access does an attacker need?
An attacker must be remotely authenticated and have basic read/search permissions. No user interaction is required, and exploitation is performed by supplying a crafted cursor parameter to the plugins/sql endpoint.
What is the impact of successful exploitation?
Successful exploitation can result in arbitrary code execution on the server. The reported impact includes compromise of confidentiality, integrity, and availability of the vulnerable server.
How can the issue be remediated?
Update the SQL plugin to repository release 2.19.6.0 for the 2.x line or 3.7.0.0 for the 3.x line.