Description
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zlt2000 | microservices-platform | ≤ 6.0.0 | — |
References
- Index name taken from the request path with no allow-list, at v6.0.0 technical-description
- Aggregation endpoint takes the index name from the path, at v6.0.0 technical-description
- Reporter proof of concept: read the sys_user index and retrieve password hashes exploit
- Reporter proof of concept: aggregate over a caller-named index exploit
- zlt2000/microservices-platform product
- VulnCheck Advisory: microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center third-party-advisory