Actively exploited · Published Jul 28, 2014 · Assigned by mitre
CVE-2014-3120
High 8.1 Exploited
In plain English
A high-severity improper access control in Elasticsearch from Elastic. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 88.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 1.4.0.Beta1 | GHSA-mrfm-jxgf-2h6v |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://www.elastic.co/blog/logstash-1-4-3-released x_refsource_CONFIRM
- 33370 exploit, x_refsource_EXPLOIT-DB
- 67731 vdb-entry, x_refsource_BID
- 106949 vdb-entry, x_refsource_OSVDB
- http://bouk.co/blog/elasticsearch-rce/ x_refsource_MISC
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce x_refsource_MISC
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch x_refsource_MISC
- https://www.elastic.co/community/security/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120 government-resource