Vulnerability Details CVE-2014-3120
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.798
EPSS Ranking 99.1%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 6.8
Proposed Action
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
Ransomware Campaign
Unknown
References
- http://bouk.co/blog/elasticsearch-rce/
- http://www.exploit-db.com/exploits/33370
- http://www.osvdb.org/106949
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
- http://www.securityfocus.com/bid/67731
- https://www.elastic.co/blog/logstash-1-4-3-released
- https://www.elastic.co/community/security/
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
- http://bouk.co/blog/elasticsearch-rce/
- http://www.exploit-db.com/exploits/33370
- http://www.osvdb.org/106949
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
- http://www.securityfocus.com/bid/67731
- https://www.elastic.co/blog/logstash-1-4-3-released
- https://www.elastic.co/community/security/
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
Products affected by CVE-2014-3120
-
cpe:2.3:a:elasticsearch:elasticsearch:1.1.1