Listen to this Post
The vulnerability CVE-2025-37736 is an improper authorization flaw (CWE-863) in Elastic Cloud Enterprise (ECE). The built-in `readonly` user account, which should only have permissions to view configuration and status data, can improperly call a set of administrative API endpoints. This occurs because the authorization checks for this role are missing or inadequate for these specific API paths.
The affected APIs allow for full management of service accounts, user accounts, and authentication keys. For example, the `readonly` user can perform `POST /platform/configuration/security/service-accounts` to create a new service account, `POST /users` to create a new user, or `DELETE /users/{user_name}` to delete an existing user. By exploiting these endpoints, an attacker with access to the `readonly` account can create new administrative-level service accounts or users, assign them API keys, and then use those new credentials to gain full administrative control over the ECE environment. This constitutes a direct privilege escalation from a low-privilege read-only user to a system administrator. The attack can be executed remotely over the network, requires low attack complexity, and no user interaction, leading to a high severity rating.
DailyCVE Form
Platform: Elastic Cloud Enterprise
Version: 3.8.0-3.8.2
Vulnerability: Privilege Escalation
Severity: High
date: 2025-11-07
Prediction: Patched 2025-11-07
What Undercode Say:
Analytics
Query logs for API calls from the readonly user to sensitive endpoints grep "readonly" /path/to/ece/logs/.log | grep -E "(POST.service-accounts|DELETE.users|POST.users|PATCH.users)" Use Elastic-provided tool to list entities created by the readonly user /path/to/ece/tooling --audit-user readonly Monitor for unexpected new user or service account creation curl -XGET -u 'admin:password' 'https://ece-host:12443/api/v1/users' | jq '.[] | .username'
How Exploit:
- Attacker gains access using compromised `readonly` user credentials.
- Attacker calls `POST /platform/configuration/security/service-accounts` to create a new high-privilege service account.
- Attacker retrieves API key for the new service account via
POST /platform/configuration/security/service-accounts/{user_id}/keys. - Attacker uses the new service account’s API key for full administrative access to ECE, compromising the CIA triad.
Protection from this CVE
Upgrade to ECE versions 3.8.3 or 4.0.3 immediately.
Audit and delete any unauthorized users or service accounts created by the `readonly` user using Elastic’s provided tooling.
Implement strict network access controls and Role-Based Access Control (RBAC).
Enforce Multi-Factor Authentication (MFA) for all administrative accounts.
Impact
Confidentiality: High (Unauthorized data access).
Integrity: High (Data and system manipulation).
Availability: High (Account/key deletion causes disruption).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
