Opensearch
CVE-2022-31115
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safe_load. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue.
AnalysisAI
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safe_load. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue. Affected products include: Amazon Opensearch. Version information: prior to 2.0.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.
More in Opensearch
View allA vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string input
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbi
Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only bas
OpenSearch is an open source distributed and RESTful search engine. Rated high severity (CVSS 8.8), this vulnerability i
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remot
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated high seve
OpenSearch is an open source distributed and RESTful search engine. Rated medium severity (CVSS 6.5), this vulnerability
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. Rated medium severity (CVSS 6.3), this v
OpenSearch is open-source software suite for search, analytics, and observability applications. Rated medium severity (C
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 202
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated medium se
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today