6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-37731

CVE-2025-37731: Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-37731

CVE-2025-37731:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.elasticsearch:elasticsearch	maven	>= 7.0.0-alpha1, < 8.19.8	8.19.8
org.elasticsearch:elasticsearch	maven	>= 9.0.0-beta1, < 9.1.8	9.1.8
org.elasticsearch:elasticsearch	maven	>= 9.2.0, < 9.2.2	9.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the PKI authentication realm of Elasticsearch, where the user's identity (principal) is extracted from a client X.509 certificate. The root cause is the use of a regular expression on the string representation of the certificate's Subject Distinguished Name (DN) within the getPrincipalFromSubjectDN function. This method is fundamentally insecure because the string representation of a DN is not guaranteed to be unambiguous and can be manipulated by an attacker who can control the fields of a certificate to be signed by a trusted Certificate Authority.

The patch addresses this by introducing a new, safer method of principal extraction. A new class, RdnFieldExtractor, is added, which parses the DER-encoded ASN.1 structure of the DN to extract a specific attribute (RDN) by its Object Identifier (OID). This is a robust method that is not susceptible to the ambiguities of string representation. The PkiRealm is modified to use this new extractor when configured via new settings (username_rdn_oid or username_rdn_name), falling back to the old, vulnerable regex-based method only for backward compatibility. The key functions authenticate and token in PkiRealm were updated to use this new, safer logic. An attacker could exploit this by presenting a crafted certificate, causing the vulnerable getPrincipalFromSubjectDN function to be called, leading to user impersonation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.