=============================== - Advisory - =============================== Tittle: ElasticSearch cloud-azure plugin - Indexes content transmitted in cleartext Risk: Medium/Low Date: 16.Sept.2015 Author: Pedro Andujar Twitter: @pandujar .: [ INTRO ] :. Elasticsearch is a search server based on Lucene. It provides a distributed, multitenant-capable full-text search engine with a RESTful web interface and schema-free JSON documents. Elasticsearch is developed in Java and is released as open source under the terms of the Apache License. ElasticSearch comes with Snapshot and Restore capabilities to use as backup. Cloud-azure plugin enables ELK to store the indexes snapshots into Azure blobs. Affected versions: ElasticSearch 1.7.2 and prior. .: [ TECHNICAL DESCRIPTION ] :. Azure recommendation: "The Microsoft Azure storage services support both HTTP and HTTPS; however, using HTTPS is highly recommended." Insecure Client Implementation: The connection string for ELK cloud-azure plugin contains hardcoded http url with the lack of encryption and certificate validation, therefore its prone to sniffing and MiTM attacks. A potential attacker with the required access to the network traffic would be able to intercept the content of the indexes snapshots. It's a good thing that Azure uses SharedKey authentication, so the account key is not sent directly through http traffic, instead it sends hmac-sha256 signature of the http headers (using the account key) for each request. Affected Src: elasticsearch/plugins/cloud-azure/src/main/java/org/elasticsearch/cloud/azure/storage/AzureStorageServiceImpl.java @Inject public AzureStorageServiceImpl(Settings settings) { super(settings); // We try to load storage API settings from `cloud.azure.` account = settings.get(ACCOUNT); key = settings.get(KEY); blob = "http://" + account + ".blob.core.windows.net/"; try { if (account != null) { logger.trace("creating new Azure storage client using account [{}], key [{}], blob [{}]", account, key, blob); String storageConnectionString = "DefaultEndpointsProtocol=http;" + "AccountName="+ account +";" + "AccountKey=" + key; // Retrieve storage account from connection-string. CloudStorageAccount storageAccount = CloudStorageAccount.parse(storageConnectionString); .: [ CHANGELOG ] :. * 10/Sept/2015: - Security at Elastic contacted. * 10/Sept/2015: - Security at Elastic ack. * 12/Sept/2015: - Elastic replies confirming they plan to fix. But is under their risk threshold to be considered a vulnerability. * 15/Sept/2015: - Quick workarround: https://github.com/elastic/elasticsearch/pull/13573 * 16/Sept/2015: - Authorized to disclose. .: [ SOLUTIONS ] :. Apply the following quickfix: https://github.com/elastic/elasticsearch/pull/13573 Consider changing your account name and key. Evaluate possible indirect impact due to stored information. .: [ REFERENCES ] :. [+] CWE-319: Cleartext Transmission of Sensitive Information https://cwe.mitre.org/data/definitions/319.html [+] OWASP 2010-A9-Insufficient Transport Layer Protection https://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection [+] ELK Security https://www.elastic.co/community/security [+] Azure SharedKey Auth https://msdn.microsoft.com/en-us/library/azure/dd179428.aspx [+] !dSR - Digital Security Research http://www.digitalsec.net/ -=EOF=-