Elasticsearch Insertion of sensitive information in audit logs

CVE-2023-31417

Summary

Elasticsearch has a flaw that permits the exposure of sensitive information, such as passwords and tokens, in audit logs under specific conditions. While Elasticsearch is designed to filter out sensitive data before logging, this functionality fails with certain deprecated API URIs. Audit logging, which is disabled by default, must be enabled explicitly for this issue to become a concern. Even when logging is active, sensitive request bodies may only appear in logs if specifically configured, hence organizations need to be aware of these settings to prevent inadvertent data leaks.

References