CVE-2024-14047: Winlogbeat Installer DOS Vulnerability

CVE-2024-14047 Overview

CVE-2024-14047 is a local privilege-related vulnerability in the Winlogbeat Windows installer from Elastic. The installer places runtime files in a directory that unprivileged users can write to. A local attacker with low privileges can pre-position malicious filesystem links, such as symbolic links or NTFS junctions, in that directory. When Winlogbeat later runs with elevated privileges, it follows those links and writes to or deletes files chosen by the attacker. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access and can result in denial of service through corruption of arbitrary files on the host.

Critical Impact
A low-privileged local user can leverage filesystem link abuse against an elevated Winlogbeat operation to overwrite or delete arbitrary files, leading to denial of service.

Affected Products

Elastic Winlogbeat for Windows (installer-deployed versions prior to 8.13.0)
Elastic Beats family components sharing the affected installer path on Windows
Windows hosts running Winlogbeat with elevated service privileges

Discovery Timeline

2026-09-01 - CVE-2024-14047 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2024-14047

Vulnerability Analysis

The Winlogbeat Windows installer stages runtime files under a directory whose access control list allows write access to standard, unprivileged users. Winlogbeat, once installed, typically runs as a Windows service under an elevated context such as LocalSystem. This mismatch between the trust level of the process and the trust level of the directory creates a classic link-following weakness classified under [CWE-59].

An attacker with an existing low-privileged foothold plants a symbolic link, NTFS junction, or hard link inside the writable runtime directory. The link points to a sensitive file elsewhere on the system. When a subsequent elevated Winlogbeat operation opens, writes, or removes the file at the link path, the operation is redirected to the attacker-chosen target. The impact recorded in the advisory is loss of integrity and availability, not confidentiality.

Root Cause

The root cause is insecure permissions on the installer-created runtime directory combined with the absence of link resolution safeguards during elevated file operations. The installer inherits or applies an ACL that grants write access to non-administrative users on a path that later receives privileged writes.

Attack Vector

Exploitation is local and requires user interaction along with a subsequent elevated action, such as an upgrade, reinstall, or service-triggered file write. The attacker must already hold a low-privileged account on the target host. The attacker prepares filesystem links inside the writable Winlogbeat directory and waits for the elevated Winlogbeat process to touch the corresponding paths. No verified public proof-of-concept has been published. See the Elastic Security Update ESA-2024-49 for vendor-provided technical context.

Detection Methods for CVE-2024-14047

Indicators of Compromise

Creation of symbolic links, junctions, or hard links inside the Winlogbeat installation or runtime directory by non-administrative user contexts.
Unexpected modification or deletion of system files that coincides with Winlogbeat service start, upgrade, or configuration reload events.
Windows event log entries showing Winlogbeat writing to paths outside its expected data and log directories.

Detection Strategies

Audit ACLs on the Winlogbeat installation directory and flag any path that grants write access to Users, Authenticated Users, or Everyone.
Enable Windows object access auditing on the Winlogbeat runtime directory to record WRITE_DAC, CREATE, and reparse point operations.
Correlate low-privileged file creation events with subsequent high-integrity Winlogbeat file operations against the same paths.

Monitoring Recommendations

Monitor Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash) for reparse point creation under the Winlogbeat directory.
Alert on any process running as LocalSystem that follows a symlink originating from a user-writable directory.
Track Winlogbeat service upgrade, restart, and installer invocation events for anomalies in timing relative to interactive logons.

How to Mitigate CVE-2024-14047

Immediate Actions Required

Upgrade Winlogbeat to a patched release as identified in the Elastic Security Update ESA-2024-49.
Inventory Windows hosts running Winlogbeat and confirm the version and installer path used during deployment.
Restrict interactive and remote logon rights on servers running Winlogbeat to reduce the pool of accounts that could stage link-based attacks.

Patch Information

Elastic addressed the issue in Winlogbeat 8.13.0. Administrators should apply the vendor-supplied installer to correct the runtime directory ACL and prevent unprivileged write access. Consult the Elastic advisory for the definitive list of fixed versions and upgrade guidance.

Workarounds

Manually tighten NTFS permissions on the Winlogbeat runtime directory to allow write access only to Administrators and SYSTEM.
Disable the creation of symbolic links for non-administrative users by revoking the SeCreateSymbolicLinkPrivilege right through Group Policy.
Limit local logon rights on Windows hosts that run Winlogbeat until the patched installer is deployed.

bash

# Configuration example: restrict Winlogbeat directory ACL
icacls "C:\Program Files\Winlogbeat" /inheritance:r
icacls "C:\Program Files\Winlogbeat" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Winlogbeat" /remove "Users" "Authenticated Users"