[GHSA-m9gh-789g-q5pv] Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

[levpachmanov]

Updates

• Affected products

Comments
The advisory lists org.elasticsearch:elasticsearch, but the vulnerable code is not in
that artifact. The flaw is in PkiRealm.getPrincipalFromSubjectDN, which extracts the
authenticated principal by running username_pattern (default CN=(.*?)(?:,|$)) with
Matcher.find() over the string form of the certificate subject DN, so a cert holder
who controls any RDN value can embed a second CN= in it and be authenticated as
another user. That class lives in x-pack/plugin/security and ships in
org.elasticsearch.plugin:x-pack-security; the default pattern lives in
PkiRealmSettings in org.elasticsearch.plugin:x-pack-core. The published
org.elasticsearch:elasticsearch jar contains none of it — zero entries for
PkiRealm, RdnField, DerParser, X509AuthenticationToken or authc/pki. Nor does
any upstream source name a Maven coordinate: Elastic's CVE record declares the product
Elasticsearch. The version data, by contrast, is correct and verifies directly against
the artifacts: the fix adds RdnFieldExtractor.class, which is absent in
x-pack-security 8.19.7, 9.1.7 and 9.2.1 and present in 8.19.8, 9.1.8 and 9.2.2 —
matching all three fixed boundaries exactly. This change therefore renames the package
on all three entries and leaves every range untouched. x-pack-security is published
continuously from 6.8.11 to 9.5.4, so every currently-flagged version keeps a Maven
signal after the change.