Elasticsearch-hadoop Unsafe Deserialization

Vulnerability

Overview

CVE-2023-46674 is an unsafe deserialization flaw in the elasticsearch-hadoop library, which integrates Elasticsearch with Hadoop and Spark ecosystems. The root cause is that the library deserializes Java objects from Hadoop or Spark configuration properties without proper validation, allowing authenticated users to supply malicious serialized data. [2][3]

Attack

Vector and Prerequisites

An attacker must have authenticated access to the Hadoop or Spark cluster and the ability to modify configuration properties used by elasticsearch-hadoop. The attack is local to the cluster environment (AV:L) and requires high privileges (PR:H) and user interaction (UI:N). [3] The exploitation complexity is high (AC:H), meaning specific conditions are needed to craft a valid malicious payload. [3]

Impact

Successful exploitation could lead to a limited loss of confidentiality (C:L), and a high impact on integrity (I:H) and availability (A:H). [3] An attacker could execute arbitrary code on the cluster nodes within the context of the Elasticsearch-Hadoop job, potentially modifying data or disrupting operations.

Mitigation

Elastic has released fixed versions 7.17.11 and 8.9.0, which resolve the unsafe deserialization issue. [3] Users should upgrade immediately. No workarounds have been published. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.