Use of Hard-coded credentials

[BhawiniTripathi]

Elasticsearch version: 6.5.1

Plugins installed: X-Pack Security

JVM version: 11.0.1

OS version: Windows 10

There is a possible vulnerability which could lead to disclosure of sensitive information and gaining unauthorized access to sensitive files. This is related to CWE-798: Use of Hard-coded Credentials.

Steps to reproduce
The code issue is located in file KeyStoreWrapper, line 40. The default pass phrase key value is hard coded which is used to decrypt the private key file. Knowing the public key, private key and algorithm methods an attacker can find a back door to break the algorithm patterns used.

[rjernst]

The keystore currently only provides obfuscation of settings. This is documented. It is in our plans to add the ability to password protect the keystore, see #32691.

Additionally, please do not open issues in github which you believe are vulnerabilities. See our guidlines on security disclosure.