-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the PKI authentication realm of Elasticsearch, where the user's identity (principal) is extracted from a client X.509 certificate. The root cause is the use of a regular expression on the string representation of the certificate's Subject Distinguished Name (DN) within the getPrincipalFromSubjectDN function. This method is fundamentally insecure because the string representation of a DN is not guaranteed to be unambiguous and can be manipulated by an attacker who can control the fields of a certificate to be signed by a trusted Certificate Authority.
The patch addresses this by introducing a new, safer method of principal extraction. A new class, RdnFieldExtractor, is added, which parses the DER-encoded ASN.1 structure of the DN to extract a specific attribute (RDN) by its Object Identifier (OID). This is a robust method that is not susceptible to the ambiguities of string representation. The PkiRealm is modified to use this new extractor when configured via new settings (username_rdn_oid or username_rdn_name), falling back to the old, vulnerable regex-based method only for backward compatibility. The key functions authenticate and token in PkiRealm were updated to use this new, safer logic. An attacker could exploit this by presenting a crafted certificate, causing the vulnerable getPrincipalFromSubjectDN function to be called, leading to user impersonation.
org.elasticsearch.xpack.security.authc.pki.PkiRealm.getPrincipalFromSubjectDNx-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/pki/PkiRealm.java
org.elasticsearch.xpack.security.authc.pki.PkiRealm.authenticatex-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/pki/PkiRealm.java
org.elasticsearch.xpack.security.authc.pki.PkiRealm.tokenx-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/pki/PkiRealm.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.elasticsearch:elasticsearch | maven | >= 7.0.0-alpha1, < 8.19.8 | 8.19.8 |
| org.elasticsearch:elasticsearch | maven | >= 9.0.0-beta1, < 9.1.8 | 9.1.8 |
| org.elasticsearch:elasticsearch | maven | >= 9.2.0, < 9.2.2 | 9.2.2 |
A Semantic Attack on Google Gemini - Read the Latest Research