Elasticsearch Insertion of sensitive information in audit logs

Vulnerability

CVE-2023-31417 is an information disclosure vulnerability in Elasticsearch where the audit logging mechanism fails to filter sensitive information—such as passwords and tokens—when requests use certain deprecated _xpack/security API URIs. Normally, Elasticsearch redacts credentials before writing to the audit log, but this filtering is bypassed for the deprecated endpoints [1][3].

Exploitation

Exploitation requires that audit logging is explicitly enabled (disabled by default) and that a request body containing credentials is logged. The attacker must have administrative access to the audit logs or the log storage system. The deprecated APIs include operations like user creation, password change, and OAuth2 token management, which inherently handle sensitive data [3]. Official Elasticsearch clients do not use these deprecated endpoints, reducing the attack surface for typical deployments.

Impact

A successful exploit could expose cleartext credentials, including passwords and authentication tokens, in the audit logs. This could allow a local attacker with access to the logs to escalate privileges or move laterally within the environment. The CVSSv3.1 score is 4.1 (Medium), reflecting the high privileges required and the need for audit logging to be enabled [3].

Mitigation

Elastic has released patches in versions 7.17.13 and 8.9.2, which resolve the issue by ensuring that sensitive data is properly filtered even when using deprecated API URIs. Users are strongly advised to upgrade to the fixed versions. As a workaround, audit logging should be carefully configured to avoid logging request bodies that may contain secrets [3].