A critical improper certificate validation vulnerability in OpenSearch Data Prepper allows attackers to intercept and modify traffic, posing a significant risk to data integrity.

This vulnerability, categorized as CWE-295, occurs because the OpenSearch sink and source plugins trust all SSL certificates when a certificate path is not explicitly configured. This allows an unauthenticated attacker positioned on the network to perform man in the middle attacks to intercept or modify sensitive observability data in transit.

The ability for an attacker to intercept or modify data in transit undermines the confidentiality and integrity of observability pipelines. Given the CVSS score of 7.4, this vulnerability represents a high risk, as it could lead to the exposure of sensitive operational data or the injection of malicious metrics into security and monitoring systems.

Immediate Action: Update OpenSearch Data Prepper to version 2.12.2 or later to enforce proper SSL certificate validation.

Proactive Monitoring: Monitor network traffic for unusual connection patterns between Data Prepper and OpenSearch clusters, and review configuration files to ensure the cert parameter is explicitly defined.

Compensating Controls: If an immediate update is not feasible, implement a workaround by manually adding the cert parameter to all OpenSearch sink or source configurations, pointing to the valid CA certificate for the cluster.

Public Exploit Available: Unknown.

Organizations utilizing OpenSearch Data Prepper should treat this vulnerability with high priority. The ease of exploitation via man in the middle techniques necessitates an immediate upgrade to version 2.12.2. If patching is delayed, ensure that all Data Prepper instances are configured to use explicit CA certificates to prevent unauthorized interception of observability data.