CVE-2016-1000222 Elasticsearch Logstash Malicious CSV Output Vulnerability (ESA-2016-01)

ElasticSearch Logstash is an open source, server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite 'stash'.

Prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.

Affected Versions:
ElasticSearch Logstash versions prior to 2.1.2 QID Detection Logic (Authenticated):
This QID checks for the installed Logstash package.

A remote attacker could exploit this vulnerability to create malicious formulas in the CSV data which may lead to further attack.

Customers are advised to upgrade to the latest version of Logstash. Refer to Logstash Downloads for more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ESA-2016-01 (Elasticsearch Logstash )