Search Guard CVE-2025-12148

Exploitation requires that Field Masking (FM) rules are configured on fields of type IP within Search Guard 3.1.1 or earlier; installations using Field Level Security (FLS) instead of FM on those fields are not affected (this is the vendor-stated workaround). The attacker must hold valid, low-privilege authenticated search access (PR:L) to an index containing such masked IP fields and be able to submit queries against the masked field. The limiting factors are substantial: it only works where FM (not FLS) is applied to IP-type fields, it requires authenticated search permissions rather than anonymous access, and it is a slow enumeration/oracle technique that reconstructs values incrementally rather than dumping data wholesale.

This is a genuine but moderate-priority confidentiality flaw, not a drop-everything emergency. The signals are internally consistent and point to targeted, low-automation abuse rather than mass exploitation. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 6.0 Medium: network-reachable but requiring low-privilege authentication (PR:L) AND a present attack requirement (AT:P), reflecting that Field Masking must actually be configured on IP-type fields and the attacker must be able to query them. Impact is confidentiality-only (VC:H, with VI/VA/all subsequent metrics = N), matching CWE-200 (Information Disclosure) - there is no integrity, availability, or code-execution exposure. EPSS is low (0.27%, 18th percentile), the CVE is NOT on CISA KEV, and no public POC was supplied, so there is no evidence of active exploitation. These signals agree: a low EPSS, no KEV, and an authentication + configuration prerequisite collectively indicate this is a real-but-contained data-reconstruction weakness exploitable mainly by insiders or already-authenticated users against installations that rely on Field Masking for IP fields. No major conflicts exist between the signals; the main caveat is that exploitation is a search-oracle side channel, which the network-vector label alone does not fully convey.

A low-privileged but authenticated Search Guard user who is only supposed to see masked (redacted) IP-address fields issues repeated search queries matching specific candidate IP values. Although the _source redacts the field, documents still return as hits when the queried IP matches, so the user treats search as an oracle and reconstructs the real IP values one query at a time. No public exploit code was identified, and the attack requires valid search credentials plus Field Masking being enabled on IP-type fields.