Advisoriesby IbisElasticsearchGHSA-mrfm-jxgf-2h6v
Elasticsearch Improper Access Control vulnerability
Fix: upgrade to 1.4.0.Beta1 or later
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 1.4.0.Beta1 | 1.4.0.Beta1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-284
- Also known as
- CVE-2014-3120
- nvd.nist.gov/vuln/detail/CVE-2014-3120
- github.com/elastic/elasticsearch/issues/7151
- github.com/elastic/elasticsearch/pull/7642
- github.com/elastic/elasticsearch/commit/bd0eb32d9c3c3f5b6e5f8630c859cd04bdcd4e06
- github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12
- github.com/elastic/elasticsearch
- web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120
- www.elastic.co/blog/logstash-1-4-3-released
- www.elastic.co/community/security
- www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
- bouk.co/blog/elasticsearch-rce
- www.exploit-db.com/exploits/33370
- www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
More Elasticsearch advisories
All Elasticsearch
Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-3337fixed in 1.4.5 +1Cross-site scripting in ElasticsearchCVE-2014-6439fixed in 1.4.0.Beta1Improper Access Control in ElasticsearchCVE-2015-1427fixed in 1.3.8 +1Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2