CVE-2025-37729: Elastic Cloud Enterprise Info Disclosure

CVE-2025-37729 Overview

CVE-2025-37729 is a server-side template injection vulnerability in Elastic Cloud Enterprise (ECE). The flaw stems from improper neutralization of special elements in the Jinjava template engine [CWE-1336]. An authenticated attacker with Admin privileges can craft input containing Jinjava expressions that the engine evaluates server-side. Successful exploitation allows the attacker to exfiltrate sensitive information and issue commands within the ECE environment. Elastic addressed the issue in ECE versions 3.8.2 and 4.0.2.

Critical Impact
An authenticated Admin can abuse Jinjava expression evaluation to read sensitive data and execute commands on Elastic Cloud Enterprise components.

Affected Products

Elastic Cloud Enterprise (ECE) versions prior to 3.8.2
Elastic Cloud Enterprise (ECE) 4.0.x versions prior to 4.0.2
Deployments using the Jinjava template engine within ECE administrative workflows

Discovery Timeline

2025-10-13 - CVE-2025-37729 published to NVD
2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-37729

Vulnerability Analysis

The vulnerability is a Server-Side Template Injection (SSTI) issue affecting the Jinjava template engine used by Elastic Cloud Enterprise. Jinjava is a Java-based template engine that follows the Jinja syntax model. When ECE renders user-controlled input through Jinjava without sufficient sanitization, the engine evaluates embedded expressions and variable references at runtime.

An attacker with Admin access can place Jinjava directives into fields that flow into the template renderer. The engine resolves these directives in its execution context, providing access to internal objects, configuration data, and command execution primitives. This converts an administrative configuration surface into a code execution path within the ECE control plane.

While exploitation requires Admin privileges, the impact is significant because it allows an admin to escape the intended configuration boundary and reach the underlying runtime. This is relevant in environments where Admin and infrastructure operator responsibilities are separated.

Root Cause

The root cause is improper neutralization of special elements used in a template engine [CWE-1336]. Input containing Jinjava control characters such as {{ }} and {% %} is interpreted by the engine instead of being treated as literal text. ECE did not enforce a strict sandbox or input allowlist before passing strings into the Jinjava renderer.

Attack Vector

The attack vector is network-based and requires high-privilege authentication. An attacker first obtains Admin access to the ECE administrative interface or API. The attacker then submits a specially crafted string containing Jinjava expressions through a field that is later rendered as a template. When ECE processes the template, the embedded expressions execute in the server context, enabling data exfiltration and command issuance.

No verified public exploit or proof-of-concept has been published. Refer to the Elastic Security Update Discussion for vendor-provided technical context.

Detection Methods for CVE-2025-37729

Indicators of Compromise

Presence of Jinjava syntax tokens such as {{, }}, {%, or %} in ECE configuration fields, deployment templates, or admin-submitted strings
Unexpected outbound connections from ECE control-plane hosts following Admin configuration changes
ECE application logs showing template rendering errors or evaluation stack traces referencing com.hubspot.jinjava
Admin API requests that include encoded or obfuscated template delimiters

Detection Strategies

Inspect ECE audit logs for Admin actions that submit values containing template delimiter characters, and correlate with subsequent process or network activity
Baseline normal Admin configuration payload patterns and alert on entries that contain expression-like syntax
Monitor for new child processes spawned by ECE Java services that do not match expected operational workflows

Monitoring Recommendations

Forward ECE application and audit logs to a centralized analytics platform and apply rules that look for template syntax in configuration write operations
Track Admin account activity, including session origin, frequency of configuration changes, and access to sensitive deployment objects
Alert on any privilege use by Admin accounts outside of approved change windows

How to Mitigate CVE-2025-37729

Immediate Actions Required

Upgrade Elastic Cloud Enterprise to version 3.8.2 or 4.0.2, depending on the deployed major release line
Audit the Admin user inventory and remove accounts that are no longer required
Rotate credentials, API keys, and tokens for any Admin account that may have been exposed
Review recent Admin configuration changes for strings containing Jinjava delimiters

Patch Information

Elastic released fixed versions ECE 3.8.2 and ECE 4.0.2. Details are provided in the Elastic Security Update Discussion (ESA-2025-21). Apply the upgrade in accordance with the standard ECE upgrade procedure.

Workarounds

Restrict Admin role assignment to the minimum number of operators required for ECE management
Enforce multi-factor authentication on all ECE Admin accounts to reduce the risk of credential abuse
Place the ECE administrative interface behind network controls that limit access to designated management networks
Enable detailed audit logging on Admin operations and route logs to an external system that the ECE Admin role cannot modify

bash

# Verify ECE version after upgrade
curl -u admin:$ECE_ADMIN_PASS \
  https://<ece-coordinator>:12443/api/v1/platform | \
  jq '.version'

# Expected output: "3.8.2" or "4.0.2" (or later)