Elastic Stack and Liferay Enterprise Search Security Advisory: CVE-2024-23445, CVE-2024-37279, CVE-2024-37280, CVE-2024-23442, CVE-2024-23443, CVE-2024-2887, CVE-2024-37281, CVE-2024-37287, CVE-2024-23444
The following issues may affect your Liferay-Elastic stack.
| CVE | Severity | Vulnerability Summary | Affected Product | Affected Versions | Solutions & Mitigations |
|---|---|---|---|---|---|
| CVE-2024-37279 | CVSSv3: 4.3(Medium) | Kibana Broken Access Control issue | Kibana | 8.6.3 through 8.13.4 | Learn more. |
| CVE-2024-23445 | CVSSv3: 6.5(Medium) | Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions | Elasticsearch | 8.10.0 through 8.14.0 | Learn more. |
| CVE-2024-37280 | CVSSv3: 4.9(Medium) | Elasticsearch StackOverflow vulnerability | Elasticsearch | 8.13.1 through 8.13.4 | Learn more. |
| CVE-2024-23443 | CVSSv3.1: 4.9(Medium) | Kibana uncontrolled resource consumption | Kibana | 7.x before 7.17.22, 8.x before 8.14.0 | Learn more |
| CVE-2024-23442 | CVSSv3: 6.1(Medium) | Kibana open redirect issue | Kibana | 7.x before 7.17.22, 8.x before 8.14.0 | Learn more. |
| CVE-2024-2887 | CVSSv3: 9.9 (Critical) | Kibana RCE due to chromium type confusion | Kibana | 7.x before 7.17.22, 8.x before 8.14.0 | Learn more. |
| CVE-2024-37281 | CVSSv3: 6.5(Medium) | Kibana Denial of Service issue | Kibana | 7.x before 7.17.23, 8.x before 8.14.0 | Learn more. |
| CVE-2024-23444 | CVSSv3: 4.9(Medium) | Elasticsearch elasticsearch-certutil csr fails to encrypt private key | Elasticsearch | 7.x before 7.17.23, 8.x before 8.13.0 | Learn more. |
| CVE-2024-37287 | CVSSv3.1: 9.1(Critical) | Kibana arbitrary code execution via prototype pollution | Kibana | 7.7.0 through 7.17.22, 8.x before 8.14.2 | Learn more. |
Additional Information
Update (September 9, 2024): Elasticsearch 8.15 has been added to the search engine compatibility matrix for the applicable Liferay versions.
The testing process to verify the compatibility with Elasticsearch and Kibana 8.14 and 8.15 is currently scheduled to be started and the updated Search Engine Compatibility Matrix is expected to be published later in August, early September.
- Regarding the CVEs affecting Kibana: The Liferay Enterprise Search Monitoring application, used to integrate Kibana’s UI as a proxy into Liferay, does not include the binaries of the Kibana application itself. Patching or updating Kibana through the installation of Liferay hotfixes or upgrading to newer quarterly releases is not applicable. In addition, Liferay does not have further information about the vulnerabilities and their exploit-ability beyond what’s shared in the public security alerts issued by the vendor (Elastic).
- Regarding CVE-2024-37280: Liferay’s out-of-the-box implementation does not use “passthrough” type in the field mappings affected by the vulnerability.
- Regarding CVE-2024-23444: Liferay’s Elasticsearch integration does not use the elasticsearch-certutil directly. This utility is only executed by users when setting-up and configuring Elasticsearch with security.
- Regarding CVE-2024-23445: Liferay’s features do not use cross-cluster API key affected by the vulnerability.
The next scheduled bump of the bundled Sidecar Elasticsearch server (convenient for development and testing, not is suitable for production, neither supported) can be tracked here.
Search Engine Compatibility
As usual, Liferay recommends to its customers to upgrade their production Elastic stack to the latest available and compatible release of 7.x/8.x. Reference the information here for the detailed Elasticsearch compatibility including the compatible connector versions and required update/patch levels.