CVE-2023-49921
📋 TL;DR
This CVE allows sensitive Elasticsearch document contents to be exposed in application logs when Watcher search input is configured with DEBUG logging. Only affects Elasticsearch users who have Watcher enabled with search input watches and DEBUG logging set for relevant loggers.
💻 Affected Systems
- Elasticsearch
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive data from Elasticsearch documents (PII, credentials, proprietary information) is written to log files accessible to unauthorized users.
Likely Case
Accidental exposure of non-sensitive indexed data in logs accessible to administrators or monitoring systems.
If Mitigated
No data exposure if DEBUG logging is disabled or patched versions are used.
🎯 Exploit Status
Exploitation requires specific configuration conditions and access to log files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Elasticsearch 8.11.2 or 7.17.16
Vendor Advisory: https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179
Restart Required: Yes
Instructions:
1. Download Elasticsearch 8.11.2 or 7.17.16 from elastic.co. 2. Stop Elasticsearch service. 3. Backup data and configuration. 4. Install new version. 5. Restart Elasticsearch service.
🔧 Temporary Workarounds
Disable DEBUG logging for Watcher search input
allChange logger levels from DEBUG to INFO or higher for watcher search input loggers
Update log4j2.properties: set logger.org.elasticsearch.xpack.watcher.input.search.level = INFO
🧯 If You Can't Patch
- Ensure DEBUG logging is disabled for all watcher-related loggers
- Restrict access to Elasticsearch log files to authorized personnel only
🔍 How to Verify
Check if Vulnerable:
Check Elasticsearch version and verify if DEBUG logging is enabled for watcher search input loggers in log configuration.Check Version:
curl -X GET "localhost:9200" | grep numberVerify Fix Applied:
Verify Elasticsearch version is 8.11.2/7.17.16 or higher and check that search results are not logged at DEBUG level.📡 Detection & Monitoring
Log Indicators:
- DEBUG level logs containing 'org.elasticsearch.xpack.watcher.input.search' with document contents
Network Indicators:
- None - this is a local logging issue
SIEM Query:
source="elasticsearch.logs" AND log_level="DEBUG" AND (logger="org.elasticsearch.xpack.watcher.input.search" OR logger="org.elasticsearch.xpack.watcher.input")