CVE-2024-14047: CWE-59 Improper Link Resolution Before File Access ('Link Following') in Elastic Elastic Security

This vulnerability arises because the Winlogbeat Windows installer places runtime files in a directory writable by unprivileged users. An attacker with low privileges and existing system access can pre-position malicious symbolic or hard links. When Winlogbeat runs with elevated privileges and follows these links, it may write to or delete arbitrary files, causing denial of service. The CVSS 3.1 score is 7.2 (high severity) with vector AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H, indicating local attack vector, high attack complexity, low privileges required, user interaction needed, and impact on integrity and availability with scope changed.

Successful exploitation allows a low-privileged attacker to cause denial of service by manipulating files that Winlogbeat accesses with elevated privileges. There is no confidentiality impact, but integrity and availability impacts are high. The attacker must have local access and user interaction is required.

No official fix or patch is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user write permissions to the affected directories if possible and monitor for suspicious link creation. Avoid running Winlogbeat with unnecessary elevated privileges. Follow Elastic's official advisories for updates.