GHSA-rrmm-wq7q-h4v5: OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape

The vulnerability exists in how OpenSearch Security handles field masking for specific data types. The core of the issue lies in the DlsFlsFilterLeafReader class, which is responsible for applying Document Level Security (DLS) and Field Level Security (FLS) rules. The investigation of the security patch revealed that several methods in this class, namely getPointValues, getNumericDocValues, and getSortedNumericDocValues, were only checking for FLS rules and were not correctly handling fields that were configured for masking. This meant that for masked fields of the affected types (ip, geo_point, etc.), these methods would return the original, unredacted data from the underlying Lucene index. An attacker could exploit this by crafting specific search queries (e.g., range queries) or by requesting the fields directly, thereby bypassing the field masking protection and accessing sensitive information. The patch addresses this by introducing a new check that ensures that masked fields are not returned in their original form, effectively closing the data leakage path.