CVE-2023-46672 Logstash Insertion of Sensitive Information into Log File
Attackers with log access can read sensitive keystore data if Logstash uses non-default JSON logging.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46672?
CVE-2023-46672 is a high-severity vulnerability in Elastic Logstash, published on 15 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances.
The prerequisites for the manifestation of this issue are:
* Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format.
* Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.
Weakness: CWE-532
Which versions are affected by CVE-2023-46672?
1 open source package ship an affected version, including logstash. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
logstash Bitnami | From 7.12.1 | 7.12.2, 8.11.1 |
Products include Elastic Logstash.
How do I fix CVE-2023-46672?
Upgrade logstash to a fixed version for your release line: 7.12.2 or 8.11.1.
Is CVE-2023-46672 being exploited?
There is no known exploitation of CVE-2023-46672 in the wild and no public exploit code.
Other vulnerabilities in Elastic Logstash
- CVE-2019-7612 Information disclosure in Logstash
- CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
- CVE-2019-7620 Denial of service in Logstash
- CVE-2015-5378 Information disclosure in n/a
- CVE-2016-1000221 Logstash Logs Sensitive Information
Sources
Also known as BIT-logstash-2023-46672, GHSA-r6fg-prgw-3ff5.