Executive brief
The zlt2000 microservices-platform is a Java-based service framework that includes a search-center component for querying Elasticsearch. An authorization bypass flaw allows authenticated users to read any Elasticsearch index without proper access controls, potentially exposing sensitive data including user credentials and personal information stored in indices like sys_user and sys-log.
Technical details
The vulnerability is an authorization bypass in the search-center service affecting two endpoints: POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing}. Both endpoints accept user-supplied index names as path variables and pass them directly to Elasticsearch queries without validating whether the calling user has permission to access those indices. An authenticated attacker can specify arbitrary index names (e.g., sys_user, sys-log) to retrieve full query results or aggregation statistics. The vulnerability requires valid authentication credentials but no additional user interaction. Public proof-of-concept code demonstrates extraction of user records and password hashes from protected indices.
Affected products
- zlt2000 microservices-platform through 6.0.0
Timeline
- 2026-09-16: disclosed