CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch
Attackers can enumerate valid usernames via timing differences in authentication responses when using the internal basic identity provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25806?
CVE-2023-25806 is a medium-severity vulnerability in opensearch-project security, published on 2 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
Which versions are affected by CVE-2023-25806?
4 open source packages ship an affected version, including org.opensearch.plugin:opensearch-security. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.opensearch.plugin:opensearch-security Maven | All versions | 1.3.9 |
org.opensearch.plugin:opensearch-security Maven | All versions | 1.3.9 |
org.opensearch.plugin:opensearch-security Maven | From 2.0.0 | 2.6.0 |
org.opensearch.plugin:opensearch-security Maven | From 2.0.0 | 2.6.0 |
Products include Amazon Opensearch, Amazon Opensearch Security.
How do I fix CVE-2023-25806?
Upgrade org.opensearch.plugin:opensearch-security to a fixed version for your release line: 1.3.9 or 2.6.0.
Is CVE-2023-25806 being exploited?
There is no known exploitation of CVE-2023-25806 in the wild and no public exploit code.
Other vulnerabilities in opensearch-project security
- CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby
- CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS
- CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information
- CVE-2022-41918 Issue with fine-grained access control of indices backing data streams
- CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations
Sources
Also known as GHSA-c6wg-cm5x-rqvj.