T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_es_instance_health.py:1672- Finding
Elasticsearch administrator credentials may be transmitted over plaintext HTTP
- Content
View full analysis
:9200" export ES_USERNAME="elastic" export ES_PASSWORD="" ``` ### Technical Analysis HTTP Basic authentication encodes the username and password but does not encrypt them. When `ES_ENDPOINT` is scheme-less, the script automatically prepends `http://`. It then sends the credentials through `curl -u`, which creates a Basic Authorization header over the unencrypted connection. The network requests are necessary for engine-level Elasticsearch diagnosis, but transmitting administrator credentials over HTTP is not necessary. HTTPS with certificate validation should be the mandatory default. ### Attack Path 1. An operator configures a scheme-less endpoint or follows the documented HTTP example. 2. The script normalizes the endpoint to `http://`. 3. An authenticated Elasticsearch probe is issued using `curl -u`. 4. An attacker with visibility into the network path captures the Authorization header. 5. The attacker decodes and reuses the Elasticsearch credentials. 6. If the documented `elastic` account is used, the ...[truncated 401 chars]- Remediation
View remediation