Improper access control in Elasticsearch - CVE-2015-1427
Published: February 17, 2015 / Updated: March 25, 2022
Vulnerability identifier: #VU40890
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A/U:Green
CVE-ID: CVE-2015-1427
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: Elastic Stack
Affected software:
Elasticsearch
Elasticsearch
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
How to mitigate CVE-2015-1427
Install update from vendor's website.
Sources
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
- http://www.securityfocus.com/archive/1/534689/100/0/threaded
- http://www.securityfocus.com/bid/72585
- https://access.redhat.com/errata/RHSA-2017:0868
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
- https://www.elastic.co/community/security/