Stored XSS through Vega expression validation bypass in OpenSearch Dashboards from OpenSearch

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

• OpenSearch Dashboards, open-source, self-managed: affected from v2.0.0 through v2.19.0 and from v3.0.0 through v3.5.0, matching the minor releases enumerated in the AWS advisory. Confirmed fixed releases are v2.19.5 and v3.6.0. The status of parallel or separately maintained branches is not listed independently and should be checked against the advisory and the deployed branch.
• Amazon OpenSearch Service, AWS managed: the advisory lists v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, and v3.5.0 as affected versions. AWS states that the affected service versions have been patched through a service software update.
• Amazon OpenSearch Serverless: not affected according to the advisory.

The flaw is in input validation for the Vega expression function implementation in OpenSearch Dashboards. The checkForFunctionProperty routine checked objects but did not recurse into objects contained inside arrays, allowing a function property nested in an array to bypass validation. A remote authenticated actor needs dashboard or visualization write permission to save a crafted Vega visualization; when another user renders that visualization, arbitrary JavaScript can execute in the context of that user's browser session. The fixing change adds array handling and a corresponding test, while the vendor advisory states that the releases also include additional hardening of Vega expression validation. The available evidence does not describe a specific payload, endpoint, abused browser API, or direct server-side code execution path.

The flaw is network reachable and requires an authenticated actor with dashboard or visualization write permission. The record describes low attack complexity and passive user interaction, meaning another user's browser session must interact with or render the saved visualization; the precise victim action is not documented. The record does not identify a public exploit and does not provide a confirmed status for exploitation in the wild. That absence of information does not prove that exploitation has not occurred.

The flaw allows arbitrary JavaScript to execute in another user's browser-session context when that user interacts with a saved visualization. The practical effect could extend to data and dashboard actions available to the victim, but the record does not define the permissions of every affected role. The attacker does not need system administrator access, but must already have dashboard or visualization write permission. The available evidence does not show server-side code execution, direct availability impact, or a server authentication bypass.

A malicious visualization can persist in a dashboard and trigger when other users use that dashboard, rather than affecting only the actor who created it. JavaScript running in a victim's session could, depending on that session's permissions, read displayed data or perform actions as the user; this is a possible consequence, not evidence of a specific breach. The primary risk is to the confidentiality and integrity of affected browser sessions, while the available evidence does not establish server-side code execution or loss of OpenSearch service availability.

1. Self-managed OpenSearch Dashboards: upgrade within the applicable branch to v2.19.5 or v3.6.0. These are the fixed releases confirmed by the advisory; select the release matching the deployed branch and do not infer the status of another branch without verification.
2. Amazon OpenSearch Service: apply the AWS service software update to the domain. The advisory states that no engine-version upgrade is required; domains with automatic software updates enabled receive the update during the next off-peak window.
3. Until updating is possible, restrict write access to visualization and saved-object APIs to trusted users and consider disabling the Vega visualization type. These measures reduce exposure but do not replace the fix.
4. If using a fork or derivative, incorporate the change that fixes checkForFunctionProperty and the related Vega expression-validation hardening, then run the appropriate test suite before deployment.
5. After updating, verify the actual version of each deployment and review Vega visualizations saved by write-capable accounts while the deployment was exposed.

1. Inventory self-managed OpenSearch Dashboards deployments and Amazon OpenSearch Service domains, then compare their running versions with the affected and fixed deployment-specific lists.
2. Identify deployments where users who are not fully trusted can write dashboards, visualizations, or saved objects, and prioritize those accounts for review.
3. Review saved Vega visualizations for unexpected changes, especially function properties nested inside objects within arrays. This is a mechanism-based review, not a vendor-confirmed IOC.
4. Review audit records for dashboard and visualization saves or modifications, then correlate those objects with subsequent access by other users.
5. No specific log event, signature, or IOC is established by the available sources. The absence of suspicious log evidence is not sufficient to establish safety; confirm the running version and apply the fix.