CVE-2025-35434
📋 TL;DR
CISA Thorium versions before 1.1.2 fail to validate TLS certificates when connecting to Elasticsearch, allowing man-in-the-middle attacks. An unauthenticated attacker with network access to a Thorium cluster could impersonate the Elasticsearch service and potentially intercept or manipulate data. This affects all deployments using vulnerable Thorium versions.
💻 Affected Systems
- CISA Thorium
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept sensitive data flowing between Thorium and Elasticsearch, inject malicious data, or disrupt operations by impersonating the Elasticsearch backend.
Likely Case
Data interception leading to information disclosure of security telemetry and operational data stored in Elasticsearch.
If Mitigated
Limited impact due to network segmentation and proper TLS certificate validation in place.
🎯 Exploit Status
Exploitation requires network access to intercept or spoof TLS traffic between Thorium and Elasticsearch. No authentication needed but requires man-in-the-middle position.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2
Vendor Advisory: https://github.com/cisagov/thorium/releases/tag/1.1.2
Restart Required: No
Instructions:
1. Download Thorium version 1.1.2 or later from GitHub releases. 2. Replace existing Thorium binary with patched version. 3. Verify TLS certificate validation is now enforced in Elasticsearch connections.
🔧 Temporary Workarounds
Enforce TLS certificate validation via configuration
allConfigure Thorium to enforce TLS certificate validation for Elasticsearch connections if supported in current version.
Check Thorium configuration documentation for TLS validation settings
Network segmentation and monitoring
allIsolate Thorium and Elasticsearch communication to trusted network segments and monitor for unusual traffic patterns.
🧯 If You Can't Patch
- Implement strict network segmentation between Thorium and Elasticsearch to prevent man-in-the-middle attacks
- Monitor network traffic between Thorium and Elasticsearch for suspicious TLS handshake patterns or certificate errors
🔍 How to Verify
Check if Vulnerable:
Check Thorium version. If version is below 1.1.2 and configured to use Elasticsearch backend, it is vulnerable.Check Version:
thorium --version or check Thorium binary/package versionVerify Fix Applied:
After upgrading to 1.1.2+, verify that Thorium now validates TLS certificates when connecting to Elasticsearch by checking connection logs or testing with invalid certificates.📡 Detection & Monitoring
Log Indicators:
- Failed TLS certificate validation errors in Thorium logs
- Unexpected Elasticsearch connection failures
Network Indicators:
- Unencrypted or improperly encrypted traffic between Thorium and Elasticsearch
- Suspicious TLS handshake patterns
SIEM Query:
source="thorium" AND ("certificate" OR "TLS" OR "SSL") AND ("fail" OR "error" OR "invalid")