A newly uncovered offensive security tool, known as RAVEN, highlights potential data-loss scenarios through compromised Elasticsearch environments. This tool demonstrates how attackers maintain access even after security measures, such as password rotations, are implemented.
Understanding RAVEN’s Attack Path
RAVEN showcases the actions a malicious actor could undertake post-breach of an exposed cluster or following control over Kibana. The attack initiates after the reconnaissance phase, exploiting vulnerabilities to infiltrate the system.
Once inside, the attacker can query the Elasticsearch database, copy data, and establish alternate credentials. Moreover, they can install mechanisms to regain access, even after defenders attempt to clear the threat.
Capabilities and Risks of RAVEN
LevelBlue researchers, in a report shared with Cyber Security News, emphasize that RAVEN is intended for penetration testing rather than evidence of an ongoing criminal operation. However, its techniques underline the risks associated with inadequate data security.
The tool can exfiltrate data using the Point-in-Time API for newer Elasticsearch versions, or the Scroll API for older ones, making it possible to gather extensive datasets from compromised environments.
RAVEN can also create snapshots internally within Elasticsearch, minimizing network traffic and reducing detection likelihood. This poses a significant business risk, as sensitive data could be stealthily transferred to attacker-controlled servers.
Persistent Threats via API Keys
A critical aspect of RAVEN’s demonstration involves exploiting Elasticsearch API keys. These keys allow for authentication without user passwords, meaning attackers can maintain access even if passwords are changed.
The tool can list and create API keys with the same permissions as the compromised user, posing a continuous threat. Additionally, the presence of unauthorized Watcher tasks can recreate deleted users and keys, complicating cleanup efforts.
Mitigating the Risks of RAVEN
Organizations are urged to prioritize patching vulnerabilities such as those addressed in recent Elastic security updates. Limiting access to management ports and tightening credential management are critical steps in mitigating potential threats.
Security teams should conduct thorough audits of users, API keys, and Watcher configurations, revoking unknown credentials and monitoring for suspicious activities. Ongoing vigilance is essential to ensure that no unauthorized mechanisms remain within the environment.
As cyber threats evolve, integrating real-time intelligence from global security operations centers can help preemptively address new phishing and malware threats, safeguarding businesses from potential compromises.
