ElasticSearch Dynamic Script Arbitrary Java Execution

vendor:

ElasticSearch

by:

Alex Brasetvik, Bouke van der Bijl, juan vazquez

N/A

CVSS

N/A

Remote Command Execution

CWE

Product Name: ElasticSearch

Affected Version From: ElasticSearch prior to 1.2.0

Affected Version To:

Patch Exists: NO

Related CWE: CVE-2014-3120

CPE:

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1214/, https://www.rapid7.com/db/vulnerabilities/freebsd-vid-43ac9d42-1b9a-11e5-b43d-002590263bf5/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2014-1186/

Other Scripts:

Tags: rce,elasticsearch,kev,vulhub,cve,cve2014,elastic

CVSS Metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P

Nuclei References: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120, https://www.elastic.co/blog/logstash-1-4-3-released, https://nvd.nist.gov/vuln/detail/CVE-2014-3120, http://bouk.co/blog/elasticsearch-rce/, https://www.elastic.co/community/security/

Nuclei Metadata: {'max-request': 1, 'vendor': 'elasticsearch', 'product': 'elasticsearch'}

Platforms Tested: java

2014

ElasticSearch Dynamic Script Arbitrary Java Execution

This module exploits a remote command execution vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the REST API, which requires no authentication or authorization, where the search function allows dynamic scripts execution, and can be used for remote attackers to execute arbitrary Java code. This module has been tested successfully on ElasticSearch 1.1.1 on Ubuntu Server 12.04 and Windows XP SP3.

Mitigation:

Update ElasticSearch to version 1.2.0 or later. Apply necessary authentication and authorization mechanisms.

Source

ElasticSearch Dynamic Script Arbitrary Java Execution

Mitigation:

Exploit-DB raw data: