Executive Summary
A vulnerability in Elastic Cloud Enterprise (ECE) can lead to credential disclosure, allowing an attacker to add an unauthorized host to the installation. The vulnerability has a CVSS score of 6.4 and is classified as medium severity. Affected versions include ECE 1.0.0 to 3.8.5 and 4.0.0 to 4.2.0.
Technical Analysis
The vulnerability is classified as Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.
How It Gets Exploited
An attacker with access to the internal ECE platform services can exploit this vulnerability. The attacker's starting position is likely an internal network or a compromised lower-privileged platform component. The attacker can obtain the secrets, including role tokens, by reading the runtime information about platform service containers. With a role token, the attacker can add an unauthorized host to the installation with the roles of that token.
Impact Assessment
The vulnerability affects ECE versions 1.0.0 to 3.8.5 and 4.0.0 to 4.2.0. An attacker can achieve credential disclosure and potentially add an unauthorized host to the installation. The CVSS score is 6.4, indicating a medium severity level.
Recommended Actions
To mitigate this vulnerability, users should update ECE to version 3.8.6 or later, or 4.2.1 or later. Additionally, users should ensure that access to internal ECE platform services is restricted to authorized personnel and components.
Sources
- National Vulnerability Database (NVD)
- Elastic Security