CVE-2022-31022 is a medium severity vulnerability affecting the Bleve text indexing library for the Go programming language, specifically versions from 0.1.0 up to but not including 2.5.0. Bleve includes an HTTP utility package (bleve/http) intended primarily for demonstration purposes, which exposes HTTP handlers such as CreateIndexHandler and DeleteIndexHandler. These handlers allow creation and deletion of Bleve indexes via HTTP requests. The vulnerability arises because these handlers do not implement any authentication or authorization controls, nor do they enforce Role Based Access Control (RBAC) on the index assets. Consequently, an attacker who can reach these HTTP endpoints can exploit the lack of access controls to create directories (indexes) or recursively delete directories anywhere on the filesystem where the server process has write permissions. This effectively allows an authentication bypass via an alternate channel, enabling unauthorized modification of the filesystem. The issue was addressed in Bleve version 2.5.0 by relocating the HTTP handlers used only by bleve-explorer to a different package, and the project maintainers have explicitly stated that the bleve/http package is not intended for production use and lacks exhaustive input validation and security controls. The CVSS 3.1 score is 6.2 (medium), reflecting local network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There are no known exploits in the wild. The vulnerability stems from CWE-288 (Authentication Bypass Using Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function).

For European organizations using Bleve versions prior to 2.5.0 and exposing the bleve/http package in production environments, this vulnerability poses a significant risk. An attacker with network access to the exposed HTTP endpoints can create or delete index directories arbitrarily, potentially leading to unauthorized data manipulation or destruction. This could compromise the integrity of indexed data, disrupt search functionality, or cause denial of service by deleting critical directories. Since the vulnerability requires no authentication or user interaction, exploitation can be straightforward if the HTTP interface is exposed beyond trusted internal networks. The impact is particularly critical for organizations relying on Bleve for indexing sensitive or operational data, such as financial institutions, healthcare providers, or government agencies in Europe. Additionally, the ability to delete arbitrary directories owned by the server user could be leveraged to escalate attacks or disrupt services. However, the vulnerability does not directly impact confidentiality or availability, and the attack vector is local network or internal exposure, limiting risk if proper network segmentation and access controls are in place.

European organizations should immediately audit their use of Bleve to determine if the vulnerable bleve/http package is exposed in production environments. If so, they should upgrade to Bleve version 2.5.0 or later, which removes the vulnerable HTTP handlers from the main package. If upgrading is not immediately feasible, organizations must ensure that the bleve/http endpoints are not exposed to untrusted networks by implementing strict network segmentation and firewall rules limiting access only to trusted hosts. Additionally, organizations should implement external authentication and authorization layers (e.g., reverse proxies with RBAC enforcement) in front of any HTTP endpoints exposing Bleve indexes. It is critical to avoid using the bleve/http package in production environments altogether, as the project maintainers explicitly advise against it. Regularly monitoring logs for unusual index creation or deletion requests can help detect exploitation attempts. Finally, organizations should consider alternative indexing solutions that provide built-in authentication and authorization if Bleve’s limitations cannot be mitigated effectively.