Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330339);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/28");

  script_cve_id("CVE-2026-63140", "CVE-2026-63144", "CVE-2026-63263");
  script_xref(name:"IAVA", value:"2026-A-0760");

  script_name(english:"Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore,
affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories.

  - Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation
    (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an
    internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal
    errors, this terminates the affected node process. (CVE-2026-63140)

  - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted
    search request submitted by a low-privileged authenticated user. A user with read-level index access can
    submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation
    component, causing a fatal error that terminates the affected node. (CVE-2026-63144)

  - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential
    Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine
    that causes exponential CPU consumption during query evaluation. (CVE-2026-63263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c0e8fa9b");
  # https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?339e6b2b");
  # https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ed36a597");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.19, 9.3.8, or 9.4.4 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63140");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
         { 'min_version' : '8', 'fixed_version' : '8.19.19' },
         { 'min_version' : '9.0.0', 'fixed_version' : '9.3.8' },
         { 'min_version' : '9.4.0', 'fixed_version' : '9.4.4' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);