CVE-2025-62371
📋 TL;DR
OpenSearch Data Prepper versions before 2.12.2 have a vulnerability where OpenSearch sink and source plugins automatically trust all SSL certificates when no certificate path is configured. This bypasses SSL certificate validation, allowing man-in-the-middle attackers to intercept and modify data in transit. Users of Data Prepper who haven't explicitly configured certificate validation are affected.
💻 Affected Systems
- OpenSearch Data Prepper
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept, read, and modify all observability data flowing between Data Prepper and OpenSearch clusters, potentially injecting malicious data or stealing sensitive information.
Likely Case
Data integrity and confidentiality compromise in environments where attackers can perform man-in-the-middle attacks on network connections.
If Mitigated
No impact when proper certificate validation is configured or when connections are within trusted internal networks with additional security controls.
🎯 Exploit Status
Exploitation requires man-in-the-middle position on network path between Data Prepper and OpenSearch clusters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12.2
Vendor Advisory: https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-43ff-rr26-8hx4
Restart Required: Yes
Instructions:
1. Update Data Prepper to version 2.12.2 or later. 2. Restart Data Prepper services. 3. Verify connections are using proper SSL validation.
🔧 Temporary Workarounds
Configure certificate validation
allExplicitly set the cert parameter in OpenSearch sink or source configuration with the path to the cluster's CA certificate.
Add 'cert: /path/to/ca-certificate.pem' to your OpenSearch sink/source configuration
🧯 If You Can't Patch
- Ensure all Data Prepper to OpenSearch connections are within trusted internal networks with strict network segmentation
- Implement additional network security controls like VPNs or TLS inspection to prevent man-in-the-middle attacks
🔍 How to Verify
Check if Vulnerable:
Check Data Prepper version and verify if cert parameter is configured in OpenSearch sink/source plugins.Check Version:
data-prepper --versionVerify Fix Applied:
Confirm Data Prepper version is 2.12.2+ and verify SSL certificate validation is occurring for OpenSearch connections.📡 Detection & Monitoring
Log Indicators:
- SSL certificate validation warnings or errors
- Unexpected connection resets to OpenSearch
Network Indicators:
- Unencrypted or improperly validated TLS connections to OpenSearch clusters
SIEM Query:
source="data-prepper" AND ("cert" NOT IN config OR "ssl" IN log AND "validation" NOT IN log)🔗 References
- https://github.com/opensearch-project/data-prepper/commit/98fcf0d0ff9c18f1f7501e11dbed918814724b99
- https://github.com/opensearch-project/data-prepper/commit/b0386a5af3fb71094ba6c86cd8b2afc783246599
- https://github.com/opensearch-project/data-prepper/commit/db11ce8f27ebca018980b2bca863f7173de9ce56
- https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-43ff-rr26-8hx4
