HIGH8.1
GHSA-mrfm-jxgf-2h6v
Elasticsearch Improper Access Control vulnerability
Quick fix
GHSA-mrfm-jxgf-2h6v — org.elasticsearch:elasticsearch: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.4.0.Beta1</version> for org.elasticsearch:elasticsearchDetails
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.elasticsearch:elasticsearch
Introduced in:
0Fixed in: 1.4.0.Beta1Fix
# pom.xml: bump <version>1.4.0.Beta1</version> for org.elasticsearch:elasticsearchReferences
- https://nvd.nist.gov/vuln/detail/CVE-2014-3120[ADVISORY]
- https://github.com/elastic/elasticsearch/issues/7151[WEB]
- https://github.com/elastic/elasticsearch/pull/7642[WEB]
- https://github.com/elastic/elasticsearch/commit/bd0eb32d9c3c3f5b6e5f8630c859cd04bdcd4e06[WEB]
- https://github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12[WEB]
- https://github.com/elastic/elasticsearch[PACKAGE]
- https://web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731[WEB]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120[WEB]
- https://www.elastic.co/blog/logstash-1-4-3-released[WEB]
- https://www.elastic.co/community/security[WEB]
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch[WEB]
- http://bouk.co/blog/elasticsearch-rce[WEB]
- http://www.exploit-db.com/exploits/33370[WEB]
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce[WEB]