what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

ElasticSearch Search Groovy Sandbox Bypass

Posted Mar 12, 2015

Authored by juan vazquez, Cameron Morris, Darren Martyn | Site metasploit.com

This Metasploit module exploits a remote command execution (RCE) vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.4.3. The bug is found in the REST API, which does not require authentication, where the search function allows groovy code execution and its sandbox can be bypassed using java.lang.Math.class.forName to reference arbitrary classes. It can be used to execute arbitrary Java code. This Metasploit module has been tested successfully on ElasticSearch 1.4.2 on Ubuntu Server 12.04.

tags | exploit, java, remote, arbitrary, code execution

systems | linux, ubuntu

advisories | CVE-2015-1427

SHA-256 | 176b7335ffc0f7911e7044aabe3ffc56753a9bee674eb8ec914eebc3bc9e46fa

Download | Favorite | View

Related Files

No related files