5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2rjv-cv85-xhgm

GHSA-2rjv-cv85-xhgm: OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object

Impact

OpenSearch versions 2.19.2 and earlier improperly apply Field Level Security (FLS) rules on fields which are not at the top level of the source document tree (i.e., which are members of a JSON object).

If an FLS exclusion rule (like ~object) is applied to an object valued attribute in a source document, the object is properly removed from the _source document in search and get results. However, any member attribute of that object remains available to search queries. This allows to reconstruct the original field contents using range queries.

Patches

The issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.

Workarounds

If FLS exclusion rules are used for object valued attributes (like ~object), add an additional exclusion rule for the members of the object (like ~object.*).

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2rjv-cv85-xhgm

GHSA-2rjv-cv85-xhgm:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.opensearch.plugin:opensearch-security	maven	< 2.19.3.0	2.19.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in OpenSearch's Field Level Security (FLS) implementation, specifically in how it handles field exclusions for nested JSON objects. When an FLS rule was configured to exclude an entire object (e.g., ~my_object), the system would correctly remove the object from the _source field in search results. However, it failed to prevent search operations on the sub-fields of that object (e.g., my_object.sensitive_field).

An attacker with search permissions could exploit this flaw by performing operations like range queries, term queries, or aggregations directly on the sub-fields. This would allow them to infer or reconstruct the values of the supposedly protected data, bypassing the intended security control and leading to unauthorized information disclosure.

The root cause was that the code only checked for an exact match of the field name against the exclusion list. It did not recursively check if a field's parent object was excluded. The fix, implemented in the DlsFlsFilterLeafReader class, introduces a new method, isFieldExclude, which traverses up the object path of a given field to check for exclusions. This corrected logic is now applied across all functions responsible for providing field data for both search and retrieval, such as getFieldInfos, getPointValues, and the various DocValues getters, ensuring that FLS rules on objects are properly enforced on their sub-fields as well.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2rjv-cv85-xhgm: OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object

Impact

Patches

Workarounds

GHSA-2rjv-cv85-xhgm:

5.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

GHSA-2rjv-cv85-xhgm: OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object

Impact

Patches

Workarounds

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.7

5.7

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI