CVE-2025-62371: OpenSearch Data Prepper Plugins Trust All SSL Certificates by Default
Summary
CVE-2025-62371: OpenSearch Data Prepper plugins trust all SSL certificates by default. Affects org.opensearch.dataprepper.plugins:opensearch versions < 2.12.2. Fixed in 2.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSearch Data Prepper is a data processing tool that integrates with OpenSearch, allowing users to collect, process, and send data to OpenSearch clusters. The plugins for OpenSearch sink and source are designed to facilitate secure connections to OpenSearch. However, a significant vulnerability exists where these plugins trust all SSL certificates by default if no certificate path is specified, exposing users to potential man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises from the default configuration of the OpenSearch sink and source plugins in Data Prepper, which automatically adopts a 'trust all' SSL strategy when no certificate path is provided. This behavior compromises SSL certificate validation, enabling attackers to intercept and manipulate data during transmission. The risk is particularly pronounced when the 'cert' parameter is not explicitly defined, leaving connections to OpenSearch clusters vulnerable.
How To Fix
Minimum fixed version
2.12.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can implement the following workaround by adding the 'cert' parameter to their OpenSearch sink and source configurations. This parameter should point to the path of the cluster's CA certificate. Example configuration for OpenSearch sink:
sink:
- opensearch: hosts: ["https://your-opensearch-cluster:9200"] cert: /path/to/your/ca-certificate.pem
Example configuration for OpenSearch source:
source:
- opensearch: hosts: ["https://your-opensearch-cluster:9200"] connection: cert: /path/to/your/ca-certificate.pem
Conclusion
The vulnerability CVE-2025-62371 in OpenSearch Data Prepper plugins poses a significant risk by allowing untrusted SSL connections. Users are strongly advised to upgrade to version 2.12.2 or implement the suggested workaround to ensure secure data transmission.
See every vulnerability recorded for org.opensearch.dataprepper.plugins:opensearch →
FAQ
CVE-2025-62371 is a vulnerability in OpenSearch Data Prepper plugins that allows trusting all SSL certificates by default, leading to potential man-in-the-middle attacks.
This vulnerability can allow attackers to intercept and modify data in transit between your application and OpenSearch clusters, compromising data integrity and confidentiality.
If you are using a version prior to 2.12.2, you should upgrade to the latest version to mitigate the vulnerability.
Yes, you can add the 'cert' parameter to your OpenSearch configuration to specify the path to your CA certificate as a temporary measure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's status using the Vulert playground without any signup.
