CVE-2018-17247: Improper Restriction of XML External Entity Reference in Elasticsearch
Summary
CVE-2018-17247: Improper Restriction of XML External Entity Reference in Elasticsearch. Affects org.elasticsearch:elasticsearch versions >= 6.5.0, < 6.5.2. Fixed in 6.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elasticsearch is an open-source search and analytics engine built on Apache Lucene. It provides distributed, real-time search and analytics capabilities for various types of data. The Elasticsearch Security package, specifically versions 6.5.0 and 6.5.1, is affected by a vulnerability known as CVE-2018-17247. This vulnerability resides in the Machine Learning component's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager, an attacker can exploit this vulnerability to leak the content of local files on the Elasticsearch node. This could potentially grant unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Elasticsearch Security versions 6.5.0 and 6.5.1 is an XML External Entity (XXE) flaw. By sending a specially crafted request, an attacker can trigger the XXE vulnerability in the find_file_structure API. If the Java Security Manager allows external network access, the attacker can exploit this vulnerability to access the content of local files on the Elasticsearch node. This can lead to unauthorized access to sensitive information that the attacker should not have access to.
How To Fix
Latest published version: 9.5.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable external network access in the Java Security Manager configuration. By removing the policy that allows external network access, the vulnerability can be mitigated. However, this workaround may impact the functionality of certain features that require external network access.
Conclusion
The vulnerability in Elasticsearch Security versions 6.5.0 and 6.5.1 allows an attacker to access the content of local files on the Elasticsearch node. It is recommended to upgrade to version 6.5.2 or later to fix the vulnerability. If immediate upgrade is not possible, disabling external network access in the Java Security Manager configuration can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.elasticsearch:elasticsearch →
FAQ
The vulnerability allows an attacker to access the content of local files on the Elasticsearch node. This can lead to unauthorized access to sensitive information.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only versions 6.5.0 and 6.5.1 of Elasticsearch Security are affected by this vulnerability. It is recommended to upgrade to version 6.5.2 or later to fix the vulnerability.
Yes, the CVSS score for this vulnerability is 5.9.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch the vulnerability as soon as possible to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.elasticsearch:elasticsearch.
