Improper access control in Elasticsearch - CVE-2015-1427
Published: February 17, 2015 / Updated: March 25, 2022
Vulnerability identifier: #VU40890
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-1427
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected software
Elasticsearch
How to mitigate CVE-2015-1427
Install update from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #4553 - exploit-CVE-2015-1427 (Elasticsearch 1.4.0 < 1.4.2 Remote Code Execution exploit and vulnerable container) (September 1, 2020)
- Exploit #3859 - ElasticSearch - Search Groovy Sandbox Bypass (Metasploit) (August 9, 2020)
- Exploit #3860 - ElasticSearch - Unauthenticated Remote Code Execution (August 9, 2020)
- Exploit #3759 - ElasticSearch Search Groovy Sandbox Bypass (August 9, 2020)
External References
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
- http://www.securityfocus.com/archive/1/534689/100/0/threaded
- http://www.securityfocus.com/bid/72585
- https://access.redhat.com/errata/RHSA-2017:0868
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
- https://www.elastic.co/community/security/