Description

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T19:17:31.507Z",
  "pubdate": "2026-08-12T19:17:31.507Z",
  "executiveSummary": "A vulnerability exists within the threat intelligence feed parser of the OpenSearch Security Analytics plugin, classified as a Server-Side Request Forgery (SSRF) flaw.\nThis security defect allows an authenticated remote attacker to supply a maliciously crafted URL parameter to the threat intelligence source configuration endpoint.\nSuccessful exploitation of this flaw enables the adversary to induce the server into initiating arbitrary network requests, potentially leading to the unauthorized disclosure and reading of local files accessible to the underlying host system.\nThe affected systems are those running the OpenSearch Security Analytics plugin with vulnerable threat intel feed parser implementations.\nThe risk implications include potential exposure of sensitive internal system files or unintended network interactions originating from the vulnerable OpenSearch node.\nTo achieve exploitation, the attacker must possess authentication credentials and network access to the threat intelligence source configuration endpoint, allowing them to submit the crafted URL parameter required to trigger the missing input validation logic.",
  "technicalDetails": "The root cause of this vulnerability is the absence of rigorous input validation and URL sanitization mechanisms within the threat intelligence feed parser component of the OpenSearch Security Analytics plugin.\nSpecifically, when interacting with the threat intel source configuration endpoint, the application fails to adequately validate or restrict user-supplied URLs before passing them to the underlying HTTP request or file retrieval routines.\nThe vulnerable component resides in the threat intelligence feed parser logic responsible for fetching external threat data based on user-configured endpoints.\nThe attack vector requires network exposure to the OpenSearch instance and demands that the remote user is authenticated with the privileges necessary to access the threat intelligence source configuration endpoint.\nThe exploitation method involves the attacker submitting a specially crafted URL parameter—such as a file:// URI or an internal network address—to the vulnerable endpoint.\nBecause the server lacks proper input validation, the parser processes the malicious URL scheme directly.\nDuring the attack flow, the server attempts to retrieve the resource specified in the crafted parameter.\nFor local file inclusion scenarios via SSRF, the payload behavior instructs the parser to access internal filesystem paths instead of external threat intelligence feeds.\nThe post-exploitation impact includes the potential read access to local system files, depending on the file system permissions of the user account executing the OpenSearch service, as well as potential scanning or interaction with internal network resources normally isolated from external entities."
}