CWE-612 covers products that create a search index of private or sensitive documents but do not limit index access to the people who may see the originals.
Document repositories, intranets, and web sites with site search are the usual victims.
How it happens
Teams add search to make private content findable. The indexing routine reads everything, including restricted files, and stores the text. The search interface then answers queries for any user, with no check against the permissions on the source documents.
MITRE points out the danger when results include surrounding text that was not part of the query. A user without access to the file can run targeted searches and read fragments of it in the result snippets. The same issue appears in search engines not configured, or implemented, to ignore critical files that should stay hidden. Even without permission to download a file directly, a remote user could read it through the index.
The observed example is CVE-2022-41918: a search application's access control rules were not applied properly to indices for data streams, allowing the viewing of sensitive information.
What an attacker gains
The recorded impact is confidentiality, through reading application data. An attacker can mine the index with repeated queries and reassemble sensitive content piece by piece.
How to find it
Log in as a low privilege user, search for terms that only appear in restricted documents, and see whether results or snippets appear. Check which paths the indexer crawls and whether secrets, configuration, and backups are excluded.
How to fix it
The record lists no formal mitigations, so take the direct reading of the weakness.
- Apply to the index the same access rules that protect the originals, enforced at query time.
- Filter results and snippets by the caller's permissions before returning them.
- Exclude files that should remain hidden from the index entirely.
- Review index and data stream permissions whenever you add a new data source.
Quick check
Why are snippets a risk?
They can contain text surrounding the match, which exposes parts of a document the user may not be allowed to see.
