CVE-2025-62371

Executive Summary

CVE-2025-62371 is a high-severity vulnerability in OpenSearch Data Prepper, an open-source data collector for observability data. The flaw resides in the OpenSearch sink and source plugins, which, by default, trust all SSL certificates when no certificate path is explicitly provided. This behavior bypasses SSL certificate validation, making the data in transit susceptible to man-in-the-middle (MITM) attacks. An attacker positioned on the network could intercept, modify, or eavesdrop on data flowing between Data Prepper and OpenSearch clusters. The vulnerability affects all versions prior to 2.12.2. The official patch was released in version 2.12.2, and a workaround involves manually configuring the cert parameter.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the OpenSearch Data Prepper distribution. Users should verify the integrity of their Data Prepper binaries and ensure they are sourced from official OpenSearch repositories. The risk of supply chain compromise is low, but organizations should validate checksums and signatures of downloaded artifacts.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – An attacker can read all data in transit.
• Integrity (I): High – An attacker can modify data in transit.
• Availability (A): None – The vulnerability does not affect availability.

Threat Level: High. The low attack complexity and network vector make this a significant risk for any organization using Data Prepper without explicit SSL certificate configuration.

Deep Dive & Mechanics

The vulnerability is rooted in the default SSL/TLS trust behavior of the OpenSearch sink and source plugins within Data Prepper. When a user configures a connection to an OpenSearch cluster but does not provide the cert parameter (which specifies the path to the cluster's CA certificate), the plugin automatically falls back to a "trust all" strategy. This means the plugin will accept any SSL certificate presented by the server, including self-signed or malicious certificates.

Technical Flow:

1. Data Prepper initiates an SSL/TLS connection to an OpenSearch cluster.
2. The plugin checks if a CA certificate path (cert) is configured.
3. If no path is provided, the plugin uses a TrustAllStrategy that bypasses certificate validation.
4. An attacker on the network can perform a MITM attack by presenting a fake certificate.
5. Data Prepper accepts the fake certificate, and the attacker can decrypt, read, and modify the data.

This behavior is particularly dangerous in cloud or multi-tenant environments where network segmentation may not be guaranteed.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.12.2):

// Default SSL context creation without certificate validation
SSLContext sslContext = SSLContextBuilder.create()
    .loadTrustMaterial(null, TrustAllStrategy.INSTANCE) // Trusts all certificates
    .build();

Patched Code (2.12.2+):

// SSL context creation with explicit certificate validation
SSLContext sslContext = SSLContextBuilder.create()
    .loadTrustMaterial(new File(certPath), null) // Uses provided CA certificate
    .build();

The patched version requires the cert parameter to be explicitly set. If not set, the plugin will fail to connect rather than falling back to an insecure mode.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A network position between Data Prepper and OpenSearch (e.g., same subnet, compromised router, ARP spoofing).
• Data Prepper version < 2.12.2 with no cert parameter configured.

Steps:

1. Setup MITM Proxy: Use a tool like mitmproxy or Bettercap to intercept traffic.
2. Generate a Fake Certificate: Create a self-signed certificate for the OpenSearch cluster's hostname.
3. Intercept and Forward: Configure the proxy to intercept traffic to the OpenSearch cluster and present the fake certificate.
4. Capture Data: All data sent by Data Prepper (e.g., logs, metrics) will be visible in plaintext.

Example mitmproxy command:

mitmproxy --mode transparent --listen-port 8443 --ssl-insecure

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected SSL certificate errors in Data Prepper logs.
• Use network monitoring tools to detect MITM attacks (e.g., ARP spoofing detection).
• Implement strict egress filtering to limit outbound connections.

Prevention:

• Immediately upgrade to Data Prepper 2.12.2 or later.
• As a workaround, configure the cert parameter in all OpenSearch sink/source configurations.
• Use mutual TLS (mTLS) for additional security.

Indicators of Compromise (IOCs)

• Network: Unexpected SSL certificate warnings or errors in Data Prepper logs.
• Logs: Entries containing TrustAllStrategy or SSLException in Data Prepper logs.
• File System: Presence of unauthorized CA certificates in the Data Prepper configuration directory.
• Network Traffic: Unencrypted or suspiciously encrypted traffic between Data Prepper and OpenSearch.

Detection Engineering

YARA Rule

rule CVE_2025_62371_DataPrepper_SSL_Bypass {
    meta:
        description = "Detects Data Prepper configurations with SSL bypass"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "TrustAllStrategy" nocase
        $s2 = "loadTrustMaterial" nocase
        $s3 = "cert" nocase
    condition:
        all of ($s1, $s2) or ($s2 and not $s3)
}

Sigma Rule

title: CVE-2025-62371 - OpenSearch Data Prepper SSL Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Data Prepper logs indicating SSL certificate validation bypass
author: Valters IT
date: 2025/04/10
logsource:
    product: opensearch
    service: data-prepper
detection:
    selection:
        EventID: 1001
        Message|contains: 'TrustAllStrategy'
    condition: selection
falsepositives:
    - Legitimate use of self-signed certificates with explicit configuration
level: high

Suricata Rule

alert tcp any any -> any 9200 (msg:"CVE-2025-62371 - OpenSearch Data Prepper SSL Bypass"; flow:to_server; content:"|16 03|"; depth:2; content:"|01|"; within:1; content:"|00 00|"; within:2; content:"|0b 00|"; within:2; content:"|00 00 00 00 00 00 00 00|"; within:8; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Data Prepper to version 2.12.2 or later.
2. Workaround: If upgrade is not possible, explicitly configure the cert parameter in all OpenSearch sink and source configurations with the path to the cluster's CA certificate.

Long-term Measures:

• Implement a certificate management policy for all internal services.
• Use network segmentation to limit exposure of Data Prepper and OpenSearch clusters.
• Enable mutual TLS (mTLS) for all inter-service communication.
• Regularly audit SSL/TLS configurations using tools like testssl.sh.

Verification:

• After applying the patch, verify that connections fail if no cert parameter is provided.
• Use network scanners to ensure no services are accepting untrusted certificates.

Valters IT
Securing Digital Frontiers