CVE-2024-23448 APM Server Insertion of Sensitive Information into Log File
Attackers with log access can read sensitive data leaked into APM Server logs when Elasticsearch indexing fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23448?
CVE-2024-23448 is a medium-severity vulnerability in Elastic APM Server, published on 7 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Weakness: CWE-532
Which versions are affected by CVE-2024-23448?
3 open source packages ship an affected version, including github.com/elastic/apm-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/elastic/apm-server Go | All versions | None |
github.com/elastic/apm-server Go | All versions | 8.12.1 |
github.com/elastic/apm-server Go | All versions | 8.12.1 |
Products include Elastic Apm Server.
How do I fix CVE-2024-23448?
Upgrade github.com/elastic/apm-server to 8.12.1 or later.
Is CVE-2024-23448 being exploited?
There is no known exploitation of CVE-2024-23448 in the wild and no public exploit code.
Other vulnerabilities in Elastic APM Server
Sources
Also known as GHSA-8r33-q5j5-rh7g, GO-2024-2556.