A critical vulnerability in ELOG allows authenticated users to overwrite configuration files, leading to denial of service or potential remote code execution.

This flaw stems from a missing authorization vulnerability (CWE-862) that allows an authenticated user to modify the system configuration. If the application is running with the -x command line flag, this issue can be escalated to arbitrary OS command execution on the host machine.

The ability to overwrite configuration files presents a significant risk to service availability, as an attacker could easily trigger a denial of service. Furthermore, in environments where the execute facility is enabled, the risk escalates to full system compromise. With a CVSS score of 7.1, this vulnerability is classified as High, reflecting the potential for severe operational disruption and unauthorized administrative control.

Immediate Action: Review the current deployment configuration and ensure that the -x flag is disabled unless strictly required for operations. Check the provided Bitbucket commit references to identify the specific code changes required to patch your local installation.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or modify configuration files. Watch for anomalous process creation events that may indicate exploitation of the execute facility.

Compensating Controls: Restrict access to the ELOG interface to trusted users via network-level controls, such as VPNs or IP whitelisting, to minimize the attack surface. Ensure that the service runs with the least privilege necessary to limit the impact of potential command execution.

Public Exploit Available: Unknown

Given the severity of the potential impact, organizations should prioritize auditing their ELOG instances to determine if the -x flag is currently active. Administrators must apply the upstream fixes available in the project repository as soon as they are integrated into a stable release. Restricting access to the application is a vital interim measure to prevent unauthorized users from leveraging this authorization bypass.