OpenSearch Alerting Improper Authorization Bypass via Execute Monitor API (GHSA-xpqp-q3wh-685q)

Vulnerability Overview Vulnerability Name: Improper authorization of Execute Monitor API Vulnerability ID: GHSA-xpqp-q3wh-685q Severity: Medium (6.5 / 10) CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None Description: OpenSearch Alerting is a plugin in the OpenSearch suite that provides monitoring, alerting, and notification capabilities. A vulnerability exists where authenticated users with the role can execute inline monitors with arbitrary data sources and input index parameters, bypassing fine-grained access control restrictions in certain scenarios. Impact: The Execute Monitor API ( ) accepts inline monitor definitions without validating whether the or fields comply with the caller's permissions. This allows authenticated users with the role to: Delete arbitrary indexes, including system indexes critical for cluster operations. Read data from arbitrary indexes, bypassing index-level permissions and enabling the extraction of data from indexes to which the caller does not have access. Exploitation requires only the standard built-in role and a single HTTP POST request. No additional privileges or customer misconfigurations are needed. Affected Versions Affected Versions: Fixed Versions: Remediation Patch: This issue has been resolved in OpenSearch Alerting versions 3.8.0 and 2.19.6. It is recommended to upgrade to the latest version and ensure that any forks or derived code are patched to include these newer versions. Workaround: If an immediate upgrade is not possible, restrict the role to trusted administrator users only to minimize exposure to this issue. Proof of Concept (POC) No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

OpenSearch Alerting Improper Authorization Bypass via Execute Monitor API (GHSA-xpqp-q3wh-685q)

More from this source