CVE-2021-22133 Information Disclosure in go.elastic.co/apm
An attacker can view sensitive HTTP headers in logs during application panics because the Go APM agent fails to sanitize them.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22133?
CVE-2021-22133 is a low-severity vulnerability in Elastic APM Agent for Go, published on 10 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.
Weakness: CWE-532
Which versions are affected by CVE-2021-22133?
3 open source packages ship an affected version, including go.elastic.co/apm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.elastic.co/apm Go | All versions | 1.11.0 |
go.elastic.co/apm Go | All versions | 1.11.0 |
go.elastic.co/apm Go | All versions | 1.11.0 |
Products include Elastic Apm Agent.
How do I fix CVE-2021-22133?
Upgrade go.elastic.co/apm to 1.11.0 or later.
Is CVE-2021-22133 being exploited?
There is no known exploitation of CVE-2021-22133 in the wild and no public exploit code.
Other vulnerabilities in Elastic APM Agent for Go
Sources
Also known as GHSA-qqc5-rgcc-cjqh, GO-2022-0706.