An authenticated remote code execution vulnerability exists in the Amazon OpenSearch Service and OpenSearch Dashboards that could allow an attacker to compromise the host server.

This vulnerability involves improper input validation leading to prototype pollution within the Time Series Visual Builder plugin. It requires the attacker to have authenticated access to the system to submit a malicious JSON payload to the metrics visualization API endpoint.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the underlying server. Given the CVSS score of 8.8, this poses a significant risk to data confidentiality, integrity, and availability, potentially leading to full system compromise and unauthorized access to sensitive data stored within the OpenSearch environment.

Immediate Action: Upgrade both Amazon OpenSearch Service and OpenSearch Dashboards to version 3.8.0 or later immediately to incorporate the necessary input validation patches.

Proactive Monitoring: Monitor API access logs for anomalous JSON payloads directed at the metrics visualization endpoint and review system logs for unexpected process execution.

Compensating Controls: Ensure that access to OpenSearch Dashboards is restricted to trusted users through robust identity and access management policies, and utilize a Web Application Firewall to inspect and block suspicious incoming JSON traffic.

Public Exploit Available: Unknown.

This is a critical security update for all users of the affected OpenSearch software versions. IT administrators should prioritize the deployment of version 3.8.0 across all production and development instances to mitigate the risk of remote code execution.