Executive brief
The Elastic APM agent for Python is a monitoring tool that collects application performance data and sends it to an Elastic APM server. When run as a CGI script, a variable naming flaw allows attackers who can control HTTP proxy headers to redirect APM telemetry data to an attacker-controlled proxy, potentially exposing performance metrics and transaction details.
Technical details
The vulnerability is a variable name clash in the Elastic APM agent for Python (versions before 5.1.0) when executed as a CGI script. An attacker with the ability to control the proxy header in incoming HTTP requests can exploit improper input validation (CWE-20) to manipulate how the agent routes APM data. The attack requires network access and is triggered when the agent processes a crafted proxy header; no authentication or user interaction is required. The impact is limited to redirection of APM telemetry; it does not provide code execution or compromise application availability. The vulnerability was fixed in version 5.1.0.
Affected products
- Elastic APM agent for Python before 5.1.0
Timeline
- 2019-08-21: disclosed
- 2019-08-21: patched: fixed in version 5.1.0