CVE-2024-23450
Denial of Service vulnerability in elasticsearch (Maven)
What is CVE-2024-23450 About?
This is a Denial of Service vulnerability in Elasticsearch that can crash an Elasticsearch node when processing documents in a deeply nested pipeline. The impact is system unavailability, and exploitation requires crafting a specific document to trigger the crash, making it moderately complex.
Affected Software
- org.elasticsearch:elasticsearch
- >7.0.0, <7.17.19
- >8.0.0, <8.13.0
Technical Details
The vulnerability in Elasticsearch arises when an ingest node processes a document that contains a deeply nested pipeline structure. The internal processing logic for such complex structures, particularly concerning resource allocation or recursion limits, appears to be insufficient. When a document with an extreme level of nesting is fed into the ingest node's pipeline, it triggers an unhandled condition or resource exhaustion, causing the Elasticsearch node process to terminate unexpectedly, resulting in a crash.
What is the Impact of CVE-2024-23450?
Successful exploitation may allow attackers to cause system instability or complete unavailability of the Elasticsearch service, disrupting operations that rely on it.
What is the Exploitability of CVE-2024-23450?
Exploitation involves crafting a specially malformed document with a deeply nested pipeline. This typically requires authenticated access to push documents to the Elasticsearch ingest node, or an attacker with the ability to inject such a document into the processing pipeline. The vulnerability is remote, as the document can be sent over the network. The complexity is moderate, as it requires knowledge of Elasticsearch's ingest pipeline structure and the ability to create a document that triggers the specific nesting depth. There are no special constraints beyond the requirement of a malformed input document.
What are the Known Public Exploits?
| PoC Author | Link | Commentary |
|---|---|---|
| No known exploits | ||
What are the Available Fixes for CVE-2024-23450?
Available Upgrade Options
- org.elasticsearch:elasticsearch
- >7.0.0, <7.17.19 → Upgrade to 7.17.19
- org.elasticsearch:elasticsearch
- >8.0.0, <8.13.0 → Upgrade to 8.13.0
Struggling with dependency upgrades?
See how Resolved Security's drop-in replacements make it simple.
Book a demoAdditional Resources
- https://security.netapp.com/advisory/ntap-20240517-0010/
- https://www.elastic.co/community/security
- https://nvd.nist.gov/vuln/detail/CVE-2024-23450
- https://www.elastic.co/community/security
- https://security.netapp.com/advisory/ntap-20240517-0010
- https://github.com/elastic/elasticsearch
- https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
- https://osv.dev/vulnerability/GHSA-w5gg-2q56-6h4f
- https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
What are Similar Vulnerabilities to CVE-2024-23450?
Similar Vulnerabilities: CVE-2023-31416 , CVE-2022-23707 , CVE-2021-44228 , CVE-2020-17530 , CVE-2019-12051
