Logstash Improper Certificate Validation in TCP Output Allowing Man-in-the-Middle Attack

A vulnerability exists in Logstash's TCP output plugin that can lead to a man-in-the-middle (MitM) attack when the plugin is used in 'client' mode with the 'ssl_verification_mode' set to 'full' (the default). In this configuration, hostname verification is not performed, leaving the connection open to interception.

Impact

Exploitation of this vulnerability could allow an attacker to intercept and potentially alter communications between Logstash and the intended recipient, creating a man-in-the-middle scenario.

Remediation

Users can upgrade to Logstash versions 8.17.6, 8.18.1, or 9.0.1 to address this vulnerability. Alternatively, the TCP output plugin can be updated to version 6.2.2 or 7.0.1.