CVE-2022-35980 : What You Need to Know

OpenSearch Security is a plugin for OpenSearch that provides encryption, authentication, and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin have an information disclosure vulnerability. When the search pattern matches an aliased index in OpenSearch clusters with advanced access controls like DLS, FLS, or field masking, requests may access sensitive information. OpenSearch 2.2.0, compatible with OpenSearch Security 2.2.0.0, includes a fix for this vulnerability.

Understanding CVE-2022-35980

This section delves into the details and impacts of the vulnerability.

What is CVE-2022-35980?

The vulnerability in OpenSearch exposes sensitive information due to improper authorization handling, affecting versions 2.0.0.0 and 2.1.0.0 of the security plugin.

The Impact of CVE-2022-35980

The issue enables unauthorized access to restricted information in OpenSearch clusters with specific access control features, potentially leading to data leaks.

Technical Details of CVE-2022-35980

Explore the technical aspects and implications of the vulnerability.

Vulnerability Description

Requests bypass filtering in OpenSearch clusters with advanced access controls, allowing access to sensitive data meant to be restricted.

Affected Systems and Versions

OpenSearch Security versions 2.0.0.0 and 2.1.0.0 are vulnerable to information disclosure when configured with certain access control settings.

Exploitation Mechanism

Aliased indexes, combined with query patterns in OpenSearch clusters, facilitate unauthorized access to restricted information.

Mitigation and Prevention

Discover the steps to mitigate and prevent exploitation of CVE-2022-35980.

Immediate Steps to Take

Update to OpenSearch 2.2.0 or higher to address the vulnerability or apply the security patch available for OpenSearch Security 2.2.0.0.

Long-Term Security Practices

Regularly update OpenSearch components and security plugins to stay protected against emerging threats.

Patching and Updates

Monitor security advisories and apply patches promptly to prevent exposure to vulnerabilities like the one in OpenSearch.