CVE-2021-22132: Elasticsearch Information Disclosure Flaw

CVE-2021-22132 Overview

CVE-2021-22132 is an information disclosure vulnerability affecting Elasticsearch versions 7.7.0 to 7.10.1. The flaw exists in the async search API, which improperly stores HTTP headers when users execute async searches. An Elasticsearch user with read access to the .tasks index could exploit this vulnerability to obtain sensitive request headers belonging to other users in the cluster, potentially exposing authentication tokens, session identifiers, or other confidential data.

Critical Impact

Attackers with limited privileges can access sensitive HTTP headers from other cluster users, potentially leading to credential theft, session hijacking, or further lateral movement within the environment.

Affected Products

• Elastic Elasticsearch versions 7.7.0 to 7.10.1
• Oracle Communications Cloud Native Core Automated Test Suite 1.8.0

Discovery Timeline

• 2021-01-14 - CVE-2021-22132 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22132

Vulnerability Analysis

This vulnerability stems from improper handling of HTTP request headers within the Elasticsearch async search feature. When a user initiates an async search operation, the system stores task metadata in the internal .tasks index. Due to insufficient data sanitization, sensitive HTTP headers from the original request are persisted alongside the task information. This creates a scenario where any user with read permissions on the .tasks index can access headers that may contain authentication credentials, API keys, or other sensitive information belonging to other users who have executed async searches.

The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), highlighting that the core issue involves the inadequate protection of sensitive credential information during storage operations.

Root Cause

The root cause lies in the async search API's failure to properly sanitize or exclude sensitive HTTP headers before persisting task information to the .tasks index. The implementation stores the complete request context, including headers that should remain confidential, without appropriate filtering mechanisms. This design oversight allows the headers to be retained in a location accessible to users with read permissions on internal indices.

Attack Vector

The attack requires network access to the Elasticsearch cluster and a user account with read permissions on the .tasks index. The attacker must wait for other users to execute async searches, after which the attacker can query the .tasks index to retrieve stored task metadata containing the victims' HTTP headers.

The exploitation process involves:

1. The attacker authenticates to the Elasticsearch cluster with credentials that grant read access to the .tasks index
2. Legitimate users execute async search queries, causing their HTTP headers to be stored
3. The attacker queries the .tasks index to retrieve task documents
4. Sensitive headers such as Authorization, X-API-Key, or custom authentication headers are extracted from the stored data

Technical details regarding exploitation can be found in the Elastic Security Update.

Detection Methods for CVE-2021-22132

Indicators of Compromise

• Unusual read queries targeting the .tasks index from non-administrative users
• Multiple queries to the .tasks index in a short timeframe from a single source
• Access patterns to the .tasks index that deviate from normal operational baselines
• Unauthorized retrieval of task documents containing HTTP header information

Detection Strategies

• Monitor Elasticsearch audit logs for read operations on the .tasks index by users who typically don't require such access
• Implement alerting for any direct queries to the .tasks index outside of normal administrative operations
• Review user permissions to identify accounts with unnecessary access to internal indices
• Deploy SentinelOne Singularity to detect anomalous data access patterns and potential credential harvesting activities

Monitoring Recommendations

• Enable Elasticsearch audit logging to capture all index access events
• Configure alerts for queries targeting internal indices including .tasks, .security, and similar system indices
• Implement user behavior analytics to identify deviations from normal access patterns
• Regularly review and audit permissions granted to users on internal Elasticsearch indices

How to Mitigate CVE-2021-22132

Immediate Actions Required

• Upgrade Elasticsearch to version 7.10.2 or later immediately
• Audit and restrict read access to the .tasks index to only essential administrative accounts
• Review audit logs for any suspicious access to the .tasks index that may indicate prior exploitation
• Rotate any credentials or API keys that may have been exposed through HTTP headers

Patch Information

Elastic has released Elasticsearch version 7.10.2 which addresses this vulnerability. The patch ensures that sensitive HTTP headers are no longer improperly stored when async search operations are executed. Organizations using Oracle Communications Cloud Native Core Automated Test Suite should apply the updates referenced in the Oracle Critical Patch Update April 2022.

Additional technical guidance is available from the NetApp Advisory.

Workarounds

• Restrict access to the .tasks index by modifying role permissions to limit read access to only trusted administrators
• Implement network segmentation to limit which systems can query internal Elasticsearch indices
• Consider disabling the async search feature if it is not required for business operations
• Apply the principle of least privilege to all Elasticsearch user accounts

# Configuration example - Restrict .tasks index access
# Add to elasticsearch.yml or configure via Kibana role management

# Example role configuration to restrict .tasks access
PUT /_security/role/restricted_user
{
  "cluster": ["monitor"],
  "indices": [
    {
      "names": ["*", "-.*"],
      "privileges": ["read", "write"]
    }
  ]
}