Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-143)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342662);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/04");

  script_cve_id("CVE-2026-78607");
  script_xref(name:"IAVA", value:"2026-A-0936");

  script_name(english:"Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-143)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x
prior to 9.4.4, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the
ESA-2026-143 advisory.

  - Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information
    disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause
    outbound inference traffic to be directed to a destination of their choosing and could cause
    administrator-provisioned credentials to be exposed. (CVE-2026-78607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-9-5-1-security-update-esa-2026-143/390094
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9349c7fc");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.19, 9.3.8, 9.4.4, or 9.5.1 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78607");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# Not checking whether the custom inference service type with secret-backed configuration is in use
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}},
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'constraints': [
        {'min_version': '8.0.0', 'fixed_version': '8.19.19'},
        {'min_version': '9.0.0', 'fixed_version': '9.3.8'},
        {'min_version': '9.4.0', 'fixed_version': '9.4.4'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);