CVE-2024-23444: Elasticsearch Information Disclosure Flaw

CVE-2024-23444 Overview

CVE-2024-23444 affects the elasticsearch-certutil CLI tool shipped with Elastic Elasticsearch. When operators invoke the tool with the csr option to generate a Certificate Signing Request (CSR), the associated private key is written to disk unencrypted. The --pass parameter, which is intended to protect the key with a passphrase, is silently ignored. Administrators relying on the documented behavior may assume their private keys are encrypted at rest when they are not. Elastic engineering discovered and disclosed the issue, classified under [CWE-311: Missing Encryption of Sensitive Data].

Critical Impact
Private keys generated through elasticsearch-certutil csr are stored unencrypted on disk, exposing TLS key material to anyone with filesystem access.

Affected Products

Elastic Elasticsearch versions prior to 8.13.0
Elastic Elasticsearch 7.x prior to 7.17.23
NetApp products bundling affected Elasticsearch versions (see NetApp Security Advisory NTAP-20250404-0001)

Discovery Timeline

2024-07-31 - CVE-2024-23444 published to the National Vulnerability Database
2025-04-04 - Last updated in NVD database following NetApp Security Advisory NTAP-20250404-0001

Technical Details for CVE-2024-23444

Vulnerability Analysis

The elasticsearch-certutil utility supports a csr mode that generates a new private key and a matching Certificate Signing Request. The command-line interface accepts a --pass flag that should encrypt the resulting private key with a passphrase, matching the behavior of the ca and cert modes. In the affected versions, the csr code path writes the private key to disk in plaintext regardless of whether --pass is supplied. Operators receive no warning that the passphrase was ignored. Any user, process, or backup system with read access to the output directory can recover the private key and use it to impersonate the eventual certificate holder.

Root Cause

The defect is a missing encryption step in the CSR generation branch of elasticsearch-certutil. The tool serializes the generated private key directly to a PEM file without invoking the PKCS#8 encryption routine that the --pass argument is meant to trigger. The vulnerability maps to [CWE-311] because sensitive cryptographic material is stored without the protection the interface advertises.

Attack Vector

An attacker who gains read access to the host running elasticsearch-certutil can exfiltrate the unencrypted key. Common exposure paths include shared build hosts, configuration management repositories that capture generated artifacts, backup archives, and container images that retain interim files. Once the CSR is signed and the certificate issued, the recovered private key enables decryption of TLS sessions, signing operations, or impersonation of the certificate subject. Refer to the Elastic security update for vendor confirmation of the behavior.

Detection Methods for CVE-2024-23444

Indicators of Compromise

PEM files produced by elasticsearch-certutil csr that begin with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PRIVATE KEY----- rather than -----BEGIN ENCRYPTED PRIVATE KEY-----.
Shell history, CI logs, or audit records showing elasticsearch-certutil csr --pass invocations on affected versions.
Private key files committed to source control or stored alongside CSR output directories.

Detection Strategies

Inventory all hosts running affected Elasticsearch versions and audit any directories used for certificate generation.
Scan filesystems and artifact repositories for unencrypted PEM private keys produced by Elasticsearch tooling.
Correlate elasticsearch-certutil execution events with file creation events to identify keys generated under the vulnerable code path.

Monitoring Recommendations

Alert on access to known certificate output directories on Elasticsearch nodes and admin workstations.
Monitor backup, snapshot, and image-build pipelines for inclusion of plaintext private key files.
Track issuance of certificates whose CSRs were generated on affected versions and prioritize them for rotation.

How to Mitigate CVE-2024-23444

Immediate Actions Required

Upgrade Elasticsearch to 8.13.0 or 7.17.23 or later as documented in the Elastic security update.
Treat any private key generated through elasticsearch-certutil csr on a vulnerable version as compromised and rotate the associated certificate.
Remove plaintext private key files from disk, backups, and source repositories after rotation.

Patch Information

Elastic addressed the issue in Elasticsearch 8.13.0 and the 7.17.23 maintenance release. NetApp published a corresponding advisory, NTAP-20250404-0001, covering bundled products. Apply vendor patches before regenerating any CSRs that require passphrase protection.

Workarounds

Generate the private key separately using a trusted tool such as openssl genpkey with passphrase protection, then create the CSR from that key.
Restrict filesystem permissions on certificate output directories to the certificate operator only, and clear the directory after CSR submission.
Run elasticsearch-certutil csr only on isolated, ephemeral hosts and securely wipe the host after the CSR workflow completes.

bash

# Generate an encrypted private key and CSR with OpenSSL as a workaround
openssl genpkey -algorithm RSA -aes-256-cbc -pkeyopt rsa_keygen_bits:2048 -out node.key
openssl req -new -key node.key -out node.csr
chmod 600 node.key