Listen to this Post
How the CVE Works
OpenSearch versions before 2.19.3.0 and 3.0.0 incorrectly enforce Field-Level Security (FLS) on nested JSON object fields. When FLS exclusion rules (e.g., ~object) are applied to an object, the object itself is removed from search results, but its nested fields remain queryable. Attackers can exploit this by using range queries to reconstruct excluded data, bypassing intended access restrictions. The vulnerability stems from improper validation of nested field permissions during query execution.
DailyCVE Form
Platform: OpenSearch
Version: < 2.19.3.0
Vulnerability: FLS bypass
Severity: Moderate
Date: Aug 1, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say
Analytics:
curl -XGET 'opensearch:9200/_search' -H 'Content-Type: application/json' -d '{"query": {"range": {"object.field": {"gte": 0}}}}'
import opensearch
es = opensearch.OpenSearch(fls_rules={"exclude": ["~object"]}) Vulnerable config
How Exploit:
- Use range queries on nested fields.
- Reconstruct excluded data via aggregation.
Protection from this CVE:
- Upgrade to OpenSearch 2.19.3.0+.
- Apply exclusion rules for nested fields (
~object.).
Impact:
- Unauthorized data access.
- Privacy violations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
