5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3xgr-h5hq-7299

GHSA-3xgr-h5hq-7299: GeoIP processor disables SSL certificate validation when downloading databases

Impact

The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks.

The GeoIP processor included a custom SSL implementation that completely bypassed certificate validation when downloading GeoIP databases from external sources. The initiateSSL() method incorrectly implemented an approach for trusting all certificates. Specifically it:

Accepted all SSL certificates without validation
Disabled server certificate verification
Disabled client certificate verification
Disabled hostname verification

This configuration made database downloads vulnerable to man-in-the-middle attacks, potentially allowing attackers to serve malicious GeoIP databases that could compromise the integrity of geolocation data processing.

Patches

Data Prepper 2.12.2 contains a fix for this issue.

Workarounds

If upgrading is not immediately possible:

Use local GeoIP database files instead of downloading from HTTP URLs
Ensure database downloads occur only over trusted networks

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3xgr-h5hq-7299

GHSA-3xgr-h5hq-7299:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.opensearch.dataprepper.plugins:geoip-processor	maven	>= 2.7.0, < 2.12.2	2.12.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by a custom and insecure SSL implementation in the GeoIP processor of Data Prepper. The DBSource.initiateSSL() method was created to intentionally bypass SSL certificate and hostname verification during the download of GeoIP databases. This method was called by HttpDBDownloadService.initiateDownload(), which is responsible for fetching the database from a URL. This creates a Man-in-the-Middle (MITM) vulnerability, allowing an attacker to intercept the connection and provide a malicious GeoIP database. The patch addresses this by completely removing the initiateSSL() method and its call from HttpDBDownloadService.initiateDownload(), thereby ensuring that the standard and secure Java TLS implementation is used for all HTTPS connections. The primary vulnerable function is DBSource.initiateSSL() due to its insecure implementation, and HttpDBDownloadService.initiateDownload() is the function that triggers the vulnerability by calling it.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.