Predictable Master Encryption Key Vulnerability in Elastic Cloud Enterprise

CVE-2018-3825

What is CVE-2018-3825?

In versions of Elastic Cloud Enterprise prior to 1.1.4, a predictable default master encryption key is employed for granting ZooKeeper access to Elasticsearch clusters. If this master key is not overridden, it remains the same across different deployments. An attacker with direct access to ZooKeeper could exploit this weakness to gain unauthorized access to sensitive configuration data from other tenant clusters, given that they know the cluster ID.

References