CVE-2021-22144

Vulnerability

Elasticsearch versions before 7.13.3 and 6.8.17 contain an uncontrolled recursion vulnerability in the Grok parser [1], [2]. A user with the ability to submit arbitrary queries to Elasticsearch can craft a malicious Grok query that triggers uncontrolled recursion, leading to a crash of the Elasticsearch node [1], [2].

Exploitation

An attacker must have the ability to submit arbitrary queries to Elasticsearch, which typically requires at least low-privileged access to the query endpoint [2]. The attacker crafts a specially designed Grok query that exploits the uncontrolled recursion weakness; no additional user interaction or network position beyond normal API access is needed [1], [2].

Impact

Successful exploitation results in a denial of service (DoS) condition as the affected Elasticsearch node crashes [1], [2]. The vulnerability does not expose data or allow code execution; the impact is limited to availability (CIA: availability loss) [2].

Mitigation

Elasticsearch 7.13.3 and 6.8.17 fix the vulnerability; users should update to these versions [2]. No workarounds are documented for unpatched instances [1], [2].