Description
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Elasticsearch | 7.10.0 – ≤ 7.13.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | elasticsearch | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Elasticsearch Memory Disclosure
auxiliary/scanner/http/elasticsearch_memory_disclosure
Exploit-DB 1
- ElasticSearch 7.13.3 - Memory disclosure EDB-50149 · webapps · Jul 23, 2021
GitHub 1 repository
-
niceeeeeeee/CVE-2021-22145-poc ★ 0 · Aug 31, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Elasticsearch 7.10.0-7.13.3 - Information Disclosure http/cves/2021/CVE-2021-22145.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.elasticsearch.client:elasticsearch-rest-client | >= 7.10.0, < 7.13.4 | 7.13.4 | GHSA-q394-h7f5-7f44 |
References
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20210827-0006/
- https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177
- http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html
- https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34 technical-description