CVE-2021-22135

Vulnerability

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw in the suggester and profile API when Document Level Security (DLS) and Field Level Security (FLS) are enabled. These APIs are normally disabled for an index under DLS, but certain queries can re-enable them, leading to information disclosure [1][2].

Exploitation

An attacker must have a valid low-privileged user account with query access to an index protected by DLS or FLS. The attacker sends a specially crafted query that re-enables the suggester or profile API, which are ordinarily blocked. No additional authentication or network position beyond normal API access is required. The exact query format is not publicly detailed in the available references [2].

Impact

A successful attack allows the attacker to learn the existence of documents and fields that they should not be able to view under the enforced DLS/FLS policies. The CVSSv3 score is 3.1 (Low), reflecting the low confidentiality impact and the requirement for authenticated access with high attack complexity [2].

Mitigation

There is no known workaround for this flaw. Users should upgrade to Elasticsearch version 7.11.2 or 6.8.15, which were released on 2021-05-13. The advisory explicitly states no workaround exists [2].