CVE-2021-22140
📋 TL;DR
This XXE vulnerability in Elastic App Search's web crawler beta feature allows attackers to read sensitive files on the host system. Attackers can exploit this by hosting a malicious sitemap.xml that gets crawled by App Search. Only organizations using the web crawler beta feature on affected versions are impacted.
💻 Affected Systems
- Elastic App Search
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete filesystem traversal leading to exposure of sensitive files like SSH keys, configuration files, and credentials stored on the host.
Likely Case
Partial filesystem access allowing attackers to read application configuration files and potentially discover other vulnerabilities.
If Mitigated
Limited impact if web crawler is disabled or only crawls trusted internal sites.
🎯 Exploit Status
Exploitation requires the attacker to control a website being crawled by App Search, making it situational but technically simple.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.12.0 or later
Vendor Advisory: https://discuss.elastic.co/t/7-12-1-security-update/271433
Restart Required: Yes
Instructions:
1. Upgrade Elastic App Search to version 7.12.0 or later. 2. Restart the App Search service. 3. Verify the version is updated.
🔧 Temporary Workarounds
Disable Web Crawler Beta Feature
allDisable the vulnerable web crawler feature until patching is possible.
Edit App Search configuration to disable web crawler or remove crawler configurations
Restrict Crawling to Trusted Sites
allConfigure the crawler to only access known, trusted websites.
Update crawler configuration to whitelist specific domains only
🧯 If You Can't Patch
- Disable the web crawler beta feature entirely
- Implement network segmentation to isolate App Search from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if App Search version is between 7.11.0 and 7.12.0 and web crawler is enabled.Check Version:
curl -X GET 'http://localhost:3002/api/ent/v1/internal/engine' | grep versionVerify Fix Applied:
Verify App Search version is 7.12.0 or later and test crawling functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in system logs
- XXE parsing errors in App Search logs
Network Indicators:
- Crawler requests to suspicious or unexpected domains
SIEM Query:
source="app-search" AND ("sitemap.xml" OR "XXE" OR "external entity")