Logstashの6.4.0以降、6.8.15以前、および7.12.0以前のバージョンにおいて、監視機能にTLS証明書検証の脆弱性が存在します。信頼できるサーバーCA証明書を指定した場合、Logstashは

The core of this vulnerability lies in Logstash's monitoring feature. When configured to use a trusted server CA certificate, Logstash fails to properly verify the certificate presented by the monitoring server. This oversight creates a critical opportunity for attackers. A malicious actor positioned between Logstash and the monitoring server could intercept the monitoring data stream, presenting a forged certificate to Logstash. Logstash, unaware of the deception, would accept the fraudulent certificate and transmit sensitive monitoring data to the attacker. The data at risk includes metrics, logs, and potentially other operational information, providing attackers with valuable insights into the system's behavior and security posture. Lateral movement within the network could be facilitated if the monitoring data reveals credentials or internal network configurations. The blast radius extends to any systems or data processed by Logstash.

Organizations heavily reliant on Logstash for centralized logging and monitoring are at significant risk. This includes environments with sensitive data flowing through Logstash, such as financial institutions, healthcare providers, and government agencies. Specifically, deployments using custom CA certificates for monitoring and those with less stringent network security controls are particularly vulnerable.

• linux / server:

journalctl -u logstash | grep -i "certificate validation"

• generic web:

curl -I <logstash_monitoring_endpoint>

Inspect the response headers for any unusual certificate information or signs of tampering. • linux / server:

lsof -i :5044 # Replace 5044 with the Logstash monitoring port

Check for unexpected connections to the monitoring port.

1. 2021-05-13Disclosure

   disclosure

2. 2021-05-13Patch

   patch

1. 予約済み2021-01-04
2. 公開日2021-05-13
3. 更新日2024-08-03
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2021-22138 is to upgrade Logstash to version 6.8.15 or 7.12.0, which contain the fix for this certificate validation flaw. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Ensure that network traffic between Logstash and the monitoring server is isolated and protected by strong network segmentation. Implement strict firewall rules to limit access to the monitoring endpoint. While not a direct fix, enabling mutual TLS (mTLS) between Logstash and the monitoring server can add an additional layer of security, requiring both parties to authenticate each other’s certificates. After upgrading, confirm the fix by verifying that Logstash correctly validates the monitoring server's certificate using a tool like openssl sclient -connect <monitoringserver_ip>:<port> -showcerts.