CVE-2018-8074

Vulnerability

CVE-2018-8074 affects the yii\elasticsearch\ActiveRecord::findOne() and yii\elasticsearch\ActiveRecord::findAll() methods in the yiisoft/yii2-elasticsearch extension for Yii 2.x versions before 2.0.15 [1][2]. The issue arises because these shortcut methods do not properly validate or prepare user-supplied input, allowing an attacker to manipulate the constructed search query. The vulnerability is a variant of the CVE-2018-7269 SQL injection issue but targets the Elasticsearch extension.

Exploitation

An attacker can exploit this vulnerability by providing crafted user input to an application that uses the affected findOne() or findAll() methods without sanitizing the input first [1][2]. No special network position or authentication is required beyond the application's normal access level. The attacker injects unintended search conditions, modifying the query sent to Elasticsearch.

Impact

Successful exploitation allows an attacker to inject different search conditions than intended, potentially retrieving unauthorized data or causing error responses from the Elasticsearch server [1][2]. The impact is primarily information disclosure and potential denial of service through malformed queries.

Mitigation

Yii released version 2.0.15 on March 21, 2018, which fixes this vulnerability by limiting findOne() and findAll() to filter only on columns that are ActiveRecord properties [1][2]. Users should upgrade to yiisoft/yii2-elasticsearch version compatible with Yii 2.0.15 or later. Application code review is also recommended to ensure user input is properly validated before being passed to these methods [1].