CVE-2024-23444 - Vulnerability Details - OpenCVE

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00155.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Elastic	Elasticsearch

Configuration 1 [-]

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-2271	Elasticsearch stores private key on disk unencrypted
Github GHSA	GHSA-5v8f-xx9m-wj44	Elasticsearch stores private key on disk unencrypted

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157
https://security.netapp.com/advisory/ntap-20250404-0001/

History

Sat, 05 Apr 2025 00:00:00 +0000

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20250404-0001/

Tue, 04 Feb 2025 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Elastic Elastic elasticsearch
CPEs		cpe:2.3:a:elastic:elasticsearch::::::::
Vendors & Products		Elastic Elastic elasticsearch

MITRE

Status: PUBLISHED

Assigner: elastic

Published: 2024-07-31T17:26:12.784Z

Updated: 2025-04-04T23:03:01.974Z

Reserved: 2024-01-16T21:31:26.029Z

Link: CVE-2024-23444

Vulnrichment

Updated: 2025-04-04T23:03:01.974Z

NVD

Status : Modified

Published: 2024-07-31T18:15:11.983

Modified: 2025-04-04T23:15:41.133

Link: CVE-2024-23444

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23444", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2024-01-16T21:31:26.029Z", "datePublished": "2024-07-31T17:26:12.784Z", "dateUpdated": "2025-04-04T23:03:01.974Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Elasticsearch", "vendor": "Elastic", "versions": [{"lessThan": "7.17.23", "status": "affected", "version": "7.x", "versionType": "custom"}, {"lessThan": "8.13.0", "status": "affected", "version": "8.x", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b><span style=\"background-color: transparent;\">It was discovered by Elastic engineering that when </span><span style=\"background-color: transparent;\">elasticsearch-certutil</span><span style=\"background-color: transparent;\"> CLI tool is used with the </span><span style=\"background-color: transparent;\">csr</span><span style=\"background-color: transparent;\"> option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the </span><span style=\"background-color: transparent;\">--pass</span><span style=\"background-color: transparent;\"> parameter is passed in the command invocation.</span></b><br>"}], "value": "It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2024-07-31T17:26:12.784Z"}, "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157"}], "source": {"discovery": "UNKNOWN"}, "title": "Elasticsearch elasticsearch-certutil csr fails to encrypt private key", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-31T18:45:22.621905Z", "id": "CVE-2024-23444", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T18:45:42.985Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250404-0001/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-04T23:03:01.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250404-0001/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-04T23:03:01.974Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23444", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-31T18:45:22.621905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T18:45:38.993Z"}}], "cna": {"title": "Elasticsearch elasticsearch-certutil csr fails to encrypt private key", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "7.x", "lessThan": "7.17.23", "versionType": "custom"}, {"status": "affected", "version": "8.x", "lessThan": "8.13.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.", "supportingMedia": [{"type": "text/html", "value": "<b><span style=\"background-color: transparent;\">It was discovered by Elastic engineering that when </span><span style=\"background-color: transparent;\">elasticsearch-certutil</span><span style=\"background-color: transparent;\"> CLI tool is used with the </span><span style=\"background-color: transparent;\">csr</span><span style=\"background-color: transparent;\"> option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the </span><span style=\"background-color: transparent;\">--pass</span><span style=\"background-color: transparent;\"> parameter is passed in the command invocation.</span></b><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2024-07-31T17:26:12.784Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23444", "state": "PUBLISHED", "dateUpdated": "2025-04-04T23:03:01.974Z", "dateReserved": "2024-01-16T21:31:26.029Z", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "datePublished": "2024-07-31T17:26:12.784Z", "assignerShortName": "elastic"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BEB91F2-7551-4E99-8960-AE85F82D8761", "versionEndExcluding": "7.17.23", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA9FE739-3345-4D11-805C-D1A035D57CCE", "versionEndExcluding": "8.13.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation."}, {"lang": "es", "value": " La ingenier\u00eda de Elastic descubri\u00f3 que cuando se utiliza la herramienta CLI elasticsearch-certutil con la opci\u00f3n csr para crear nuevas solicitudes de firma de certificado, la clave privada asociada que se genera se almacena en el disco sin cifrar incluso si se pasa el par\u00e1metro --pass en la invocaci\u00f3n del comando."}], "id": "CVE-2024-23444", "lastModified": "2025-04-04T23:15:41.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "bressers@elastic.co", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-31T18:15:11.983", "references": [{"source": "bressers@elastic.co", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20250404-0001/"}], "sourceIdentifier": "bressers@elastic.co", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "bressers@elastic.co", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "nvd@nist.gov", "type": "Primary"}]}