Advisoriesby IbisElasticsearchGHSA-w94p-6mhw-4qxw
Improper Access Control in Elasticsearch
Fix: upgrade to 1.3.8 or later (2 fixed versions below)
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 1.3.8 | 1.3.8 |
| >= 1.4.0, < 1.4.3 | 1.4.3 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-284
- Also known as
- CVE-2015-1427
- nvd.nist.gov/vuln/detail/CVE-2015-1427
- access.redhat.com/errata/RHSA-2017:0868
- exchange.xforce.ibmcloud.com/vulnerabilities/100850
- www.elastic.co/community/security
- packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released
More Elasticsearch advisories
All Elasticsearch
Cross-site scripting in ElasticsearchCVE-2014-6439fixed in 1.4.0.Beta1Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-17244fixed in 6.4.3Elasticsearch subject to cross site scriptingCVE-2018-3824fixed in 5.6.9 +1