Elastic Cloud Enterprise Improper Authorization Vulnerability Leading to Privilege Escalation

A vulnerability in Elastic Cloud Enterprise (ECE) versions 3.8.0 prior to 3.8.3 and 4.0.0 prior to 4.0.3 allows improper authorization, enabling privilege escalation. The built-in readonly user can access certain APIs that should be restricted. This issue affects all ECE users.

Impact

Exploitation of this vulnerability could allow the readonly user to call APIs related to service accounts and user authentication keys, potentially leading to unauthorized access or modification of sensitive information.

Remediation

Users should upgrade to Elastic Cloud Enterprise versions 3.8.3 or 4.0.3. After upgrading, it is recommended to check for and delete any users or service accounts created by the readonly user. For those unable to upgrade, the same cleanup process can be applied using the available tooling.