CVE-2023-46667

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737	Release Notes
https://www.elastic.co/community/security	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:*

History

03 Nov 2023, 15:38

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.1
CPE		cpe:2.3:a:elastic:fleet_server::::::::
References	~~(MISC) https://www.elastic.co/community/security -~~	(MISC) https://www.elastic.co/community/security - Vendor Advisory
References	~~(MISC) https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 -~~	(MISC) https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 - Release Notes
CWE		CWE-532
First Time		Elastic Elastic fleet Server

26 Oct 2023, 11:44

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-26 01:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-46667

Mitre link : CVE-2023-46667

CVE.ORG link : CVE-2023-46667

JSON object : View

Products Affected

elastic

fleet_server

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2023-46667", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "bressers@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-10-26T01:15:07.987", "references": [{"url": "https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737", "tags": ["Release Notes"], "source": "bressers@elastic.co"}, {"url": "https://www.elastic.co/community/security", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server\u2019s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Fleet Server en versiones >= v8.10.0 y < v8.10.3 donde los tokens de inscripci\u00f3n del agente se insertan en el archivo de registro del Fleet Server en texto plano. Estos tokens de inscripci\u00f3n podr\u00edan permitir que alguien inscriba a un agente en una pol\u00edtica de agente y potencialmente usarlo para recuperar otros secretos en la pol\u00edtica, incluso para Elasticsearch y servicios de terceros. Alternativamente, un actor de amenazas podr\u00eda potencialmente inscribir agentes en los cl\u00fasteres y enviar eventos arbitrarios a Elasticsearch."}], "lastModified": "2023-11-03T15:38:27.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B81D69-3EDE-4765-8870-E1C55A13795C", "versionEndExcluding": "8.10.3", "versionStartIncluding": "8.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}