CVE-2021-22140 XML external entity in Elastic App Search
An attacker can exploit an XML External Entity vulnerability in the beta web crawler to read sensitive files from the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22140?
CVE-2021-22140 is a high-severity vulnerability in Elastic App Search, published on 13 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.
Weakness: CWE-611
Which versions are affected by CVE-2021-22140?
It affects 1 product.
Products include Elastic Elastic App Search.
How do I fix CVE-2021-22140?
No fix has been published for CVE-2021-22140 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22140 being exploited?
There is no known exploitation of CVE-2021-22140 in the wild and no public exploit code.
Other vulnerabilities in Elastic App Search
Sources
Also known as GHSA-6j6p-6hm2-m4qc.