Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue

CVE-2023-31421

Summary

A vulnerability has been identified in which Beats, Elastic Agent, APM Server, and Fleet Server do not adequately verify server certificates when connecting to target IP addresses. While the signature of the certificate is checked, the validation process fails to confirm the server certificate's IP Subject Alternative Name (SAN) values against the actual IP being targeted. This lapse means that if configured to connect via an IP address instead of a hostname, the expected security checks are bypassed, potentially allowing unauthorized access.

References