CVE-2020-7019: Elasticsearch Information Disclosure Flaw

CVE-2020-7019 Overview

CVE-2020-7019 is a field disclosure vulnerability affecting Elasticsearch versions prior to 7.9.0 and 6.8.12. The flaw occurs when running a scrolling search with Field Level Security (FLS) enabled. If a less privileged user executes the same query that a more privileged user recently ran, the scrolling search can inadvertently leak fields that should be restricted from the lower-privileged user's view. This information disclosure vulnerability could allow an attacker to gain unauthorized access to sensitive data in restricted indices.

Critical Impact

Attackers with lower privileges can potentially access restricted fields in Elasticsearch indices by exploiting cached scrolling search results, effectively bypassing Field Level Security controls and gaining access to sensitive data they should not be authorized to view.

Affected Products

• Elastic Elasticsearch versions prior to 7.9.0
• Elastic Elasticsearch versions prior to 6.8.12

Discovery Timeline

• 2020-08-18 - CVE-2020-7019 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-7019

Vulnerability Analysis

This vulnerability is classified under CWE-270 (Privilege Context Switching Error) and CWE-269 (Improper Privilege Management). The flaw exists in how Elasticsearch handles Field Level Security during scrolling search operations.

When Elasticsearch executes a scrolling search, it maintains a search context to allow pagination through large result sets. The vulnerability arises because the field-level security filtering is not properly reapplied when a cached scroll context is reused. If a privileged user initiates a scrolling search that includes restricted fields, and a less privileged user subsequently executes the same query, the scroll context may return fields that should be filtered out based on the second user's permissions.

The attack requires network access and valid authentication credentials, but only low-level privileges are needed. The vulnerability does not affect data integrity or system availability but poses a significant confidentiality risk for organizations relying on Field Level Security to protect sensitive data within their Elasticsearch indices.

Root Cause

The root cause of CVE-2020-7019 lies in improper privilege context management during scrolling search operations. Elasticsearch's Field Level Security mechanism failed to properly re-evaluate field-level permissions when scroll contexts were accessed by different users. The scroll context retained field visibility settings from the original query creator rather than applying the permissions of the current user accessing the scroll results.

Attack Vector

The attack vector is network-based and requires the attacker to have valid, albeit low-privileged, credentials to the Elasticsearch cluster. The exploitation scenario involves:

1. A privileged user executes a scrolling search query against an index with Field Level Security configured
2. The scroll context is cached with full field visibility based on the privileged user's permissions
3. A less privileged attacker executes an identical scrolling search query
4. The attacker's query reuses the cached scroll context, bypassing Field Level Security checks
5. The attacker receives fields in the response that should be hidden based on their actual permissions

The vulnerability requires no user interaction and can be exploited remotely. The attacker does not need knowledge of the privileged user's query timing, only the ability to execute similar scrolling searches against protected indices.

Detection Methods for CVE-2020-7019

Indicators of Compromise

• Unusual scrolling search activity from lower-privileged user accounts accessing restricted indices
• Multiple users executing identical scrolling search queries within short time windows
• Audit logs showing field access patterns inconsistent with user permission levels
• Unexpected data access patterns in Field Level Security-protected indices

Detection Strategies

• Enable Elasticsearch audit logging to track scrolling search operations and compare user permissions against accessed fields
• Monitor for duplicate or near-duplicate scrolling search queries from users with different privilege levels
• Implement alerting on scrolling search operations targeting sensitive indices from users who should not have access to certain fields
• Review Elasticsearch slow logs for patterns of repeated queries that could indicate exploitation attempts

Monitoring Recommendations

• Configure Elasticsearch security audit logging at the ACCESS_GRANTED and ACCESS_DENIED levels
• Deploy SIEM rules to correlate scrolling search activities across users with different privilege levels
• Establish baseline behavior for scrolling search usage patterns per user role
• Monitor network traffic to Elasticsearch clusters for unusual _search/scroll API requests

How to Mitigate CVE-2020-7019

Immediate Actions Required

• Upgrade Elasticsearch to version 7.9.0 or later for the 7.x branch
• Upgrade Elasticsearch to version 6.8.12 or later for the 6.x branch
• Review audit logs for potential exploitation prior to patching
• Assess whether sensitive data may have been exposed through this vulnerability

Patch Information

Elastic has addressed this vulnerability in Elasticsearch versions 7.9.0 and 6.8.12. Organizations should upgrade to these versions or later as soon as possible. Detailed information about the security update is available in the Elastic Security Update Discussion. Additional advisory information is available from NetApp Security Advisory NTAP-20200827-0001.

Workarounds

• Limit scrolling search capabilities for lower-privileged users until patching is complete
• Review and restrict access to indices containing sensitive data protected by Field Level Security
• Implement additional application-level access controls to validate user permissions before returning sensitive fields
• Consider temporarily disabling scrolling search functionality for sensitive indices if patching cannot be performed immediately

# Configuration example - Restrict scroll context settings in elasticsearch.yml
# Reduce scroll context lifetime to minimize exploitation window
search.max_open_scroll_context: 500
search.default_keep_alive: "5m"
search.max_keep_alive: "10m"

# Enable comprehensive audit logging
xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: ["access_granted", "access_denied", "authentication_failed"]