Elasticsearch 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Privilege Escalation (ESA-2026-197)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363429);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2026-103007");

  script_name(english:"Elasticsearch 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Privilege Escalation (ESA-2026-197)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is,
therefore, affected by a vulnerability as referenced in the ESA-2026-197 advisory.

  - Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated
    administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch
    contains an incorrect authorization weakness in a configurable, non-default privilege that lets an
    administrator delegate limited role-management capability to another user, scoped to specific indices. The
    authorization check that enforces this scoping does not correctly account for a role-definition setting
    that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index
    pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that
    should remain restricted, including internal security data. This can enable further escalation up to full
    administrative control of the cluster. (CVE-2026-103007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://discuss.elastic.co/t/390871");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 9.4.7, or 9.5.4 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-103007");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "Elasticsearch",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "min_version": "9.0.0",
          "fixed_version": "9.4.7"
        },
        {
          "min_version": "9.5.0",
          "fixed_version": "9.5.4"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);