Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql

Summary:

• The sort_query: String argument on Query.search (hackerone.com/graphql) is passed to the downstream Elasticsearch cluster as the raw value of the sort parameter, without server-side schema validation, keyword allowlisting, or rejection of scripted sort directives.

• I confirmed per-document Painless script execution by submitting two requests that differ only in the script.source field and observing that the script's return value determined document ordering.

• The first request returned a constant sort key; the second read each document's internal _seq_no metadata field and returned it as the sort key. The result sets share zero overlapping documents in the first five positions, and the second request's ordering matches a known ascending-by-_seq_no baseline. This difference is only explainable by the Painless script compiling and executing per document against the doc context.

All testing was conducted against documents within my own authorization boundary (NotificationsIndex, scoped to my own notifications by a server-side user filter). The scripts I supplied did not read any user content, any foreign-tenant data, or any field beyond the _seq_no ES-internal metadata field.

Description: