Elasticsearch 8.x < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-56 / ESA-2026-57)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330338);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/28");

  script_cve_id("CVE-2026-56144", "CVE-2026-56145");
  script_xref(name:"IAVA", value:"2026-A-0760");

  script_name(english:"Elasticsearch 8.x < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-56 / ESA-2026-57)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.18, or 9.0.x prior to 9.3.7, 9.4.x prior to or 9.4.4. It is, therefore,
affected by multiple vulnerabilities as referenced in the ESA-2026-56 and ESA-2026-57 advisories.

  - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive
    Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries
    against an index they control can send a specially crafted query that triggers excessive memory consumption,
    causing the Elasticsearch node to crash. (CVE-2026-56145)

  - Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index
    privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting
    indices they are not authorized to access directly, the user can cause those indices' configured ingest
    pipelines to execute and return their output, potentially disclosing data processed or enriched by those
    pipelines. (CVE-2026-56144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?94b5e036");
  # https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-56/388555
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?32e0917c");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.18, 9.3.7, or 9.4.4 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56145");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
         { 'min_version' : '8', 'fixed_version' : '8.19.18' },
         { 'min_version' : '9.0.0', 'fixed_version' : '9.3.7' },
         { 'min_version' : '9.4.0', 'fixed_version' : '9.4.4' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);