Critical SSL Certificate Validation Bypass in GeoIP Processor of OpenSearch Data Prepper
Summary
GHSA-3xgr-h5hq-7299: GeoIP processor disables SSL certificate validation when downloading databases. Affects org.opensearch.dataprepper.plugins:geoip-processor versions >= 2.7.0, < 2.12.2. Fixed in 2.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GeoIP processor is a component of OpenSearch Data Prepper, which is designed to enhance data processing capabilities by providing geolocation data. This processor allows users to download GeoIP databases from external sources to enrich their data streams. However, a significant vulnerability was identified that compromises the security of these downloads, specifically by disabling SSL certificate validation.
Vulnerability Detail
The vulnerability arises from the GeoIP processor's configuration, which trusts all SSL certificates and disables hostname verification when downloading GeoIP databases from HTTP URLs. This misconfiguration allows for man-in-the-middle attacks, where an attacker could intercept and serve malicious GeoIP databases, potentially compromising the integrity of geolocation data processing. The custom SSL implementation bypasses essential security checks, including server and client certificate verification, making it highly susceptible to exploitation.
How To Fix
Minimum fixed version
2.12.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can implement the following workarounds:
- Use local GeoIP database files instead of downloading from HTTP URLs.
- Ensure that database downloads occur only over trusted networks to mitigate the risk of man-in-the-middle attacks.
Conclusion
In summary, the GeoIP processor in OpenSearch Data Prepper has a critical vulnerability that disables SSL certificate validation, exposing users to potential man-in-the-middle attacks. It is crucial to upgrade to the patched version or implement workarounds to secure your data processing activities.
See every vulnerability recorded for org.opensearch.dataprepper.plugins:geoip-processor →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include the risk of receiving malicious GeoIP databases, which could lead to incorrect geolocation data and compromise data integrity.
Yes, a patch is available in Data Prepper version 2.12.2, which addresses this vulnerability.
If immediate upgrading is not possible, consider using local GeoIP database files and ensure downloads occur over trusted networks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opensearch.dataprepper.plugins:geoip-processor.
