Skip to content

Latest commit

 

History

History
61 lines (53 loc) · 4.02 KB

attack-tree.md

File metadata and controls

61 lines (53 loc) · 4.02 KB

Attack Tree Analysis for olivere/elastic

Objective: To gain unauthorized access to data or modify data within the Elasticsearch cluster, and by extension, the application using olivere/elastic, by exploiting vulnerabilities in the application's use of the olivere/elastic client.

Attack Tree Visualization

[Compromise Application via olivere/elastic]
                    |
    ---------------------------------
    |                               |
[Data Exfiltration]        [Data Modification/Corruption]
    |
-----------------       -----------------
|               |       |               |
[Exploit Search]       [Exploit Indexing]
[    Queries   ]       [               ]
    |                       |
---------               ---------
|       |               |       |
[!!!Query]               [!!!Unsafe]
[Injection]               [  Delete ]
[via Search]             [Operations]
[    DSL  ]

Attack Tree Path: Data Exfiltration

  • Exploit Search Queries:
    • !!!Query Injection (via Search DSL)!!!:
      • Description: The attacker crafts malicious input that, when incorporated into an Elasticsearch query by the application, alters the query's intended logic. This allows the attacker to bypass security restrictions and retrieve data they should not have access to. The olivere/elastic client executes the query as constructed by the application; the vulnerability lies in how the application builds the query string.
      • Likelihood: High (if input validation is poor) / Medium (with some basic validation)
      • Impact: High to Very High (depending on the sensitivity of the data accessible)
      • Effort: Low to Medium
      • Skill Level: Beginner to Intermediate
      • Detection Difficulty: Medium (if logging queries) / Hard (if no query logging)
      • Mitigation:
        • Crucially Important: Never directly embed user input into query strings.
        • Use parameterized queries (e.g., elastic.NewTermQuery, elastic.NewMatchQuery, etc.) where the library handles escaping.
        • Validate and sanitize all user input before using it, even in parameterized queries.
        • Implement strict input validation based on expected data types and formats.
        • Use a query builder approach rather than string concatenation.
        • Implement Web Application Firewall (WAF) rules to detect and block common injection patterns.

Attack Tree Path: Data Modification/Corruption

  • Exploit Indexing:
    • !!!Unsafe Delete Operations!!!:
      • Description: The application allows users (or unauthenticated requests) to trigger delete operations on Elasticsearch documents or indices without proper authorization checks. The olivere/elastic client provides the API calls (e.g., Delete, DeleteByQuery, DeleteIndex), but the application must control when and how these are used.
      • Likelihood: Medium (if authorization is weak) / Low (with good authorization)
      • Impact: High to Very High (potential data loss, data corruption, application malfunction)
      • Effort: Low
      • Skill Level: Beginner
      • Detection Difficulty: Medium (if auditing delete operations) / Hard (without auditing)
      • Mitigation:
        • Implement robust authorization checks before executing any delete operation.
        • Ensure only authorized users/roles can perform deletions, based on a well-defined access control policy.
        • Consider using soft deletes (marking documents as deleted instead of physically removing them) to allow for recovery.
        • Implement an audit trail for all delete operations, logging who performed the deletion, when, and on what data.
        • Use Elasticsearch's built-in security features (if available in your version) to enforce document- and field-level security.