Actively exploited · Published Feb 17, 2015 · Assigned by mitre
CVE-2015-1427
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Elasticsearch from Elastic. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 1.3.8 | GHSA-w94p-6mhw-4qxw |
| Maven | org.elasticsearch:elasticsearch | 1.4.3 | GHSA-w94p-6mhw-4qxw |
Affected products (as reported)
References
- 20150211 Elasticsearch vulnerability CVE-2015-1427 mailing-list, x_refsource_BUGTRAQ
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html x_refsource_MISC
- RHSA-2017:0868 vendor-advisory, x_refsource_REDHAT
- 72585 vdb-entry, x_refsource_BID
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ x_refsource_CONFIRM
- elasticsearch-cve20151427-command-exec(100850) vdb-entry, x_refsource_XF
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html x_refsource_MISC
- https://www.elastic.co/community/security/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427 government-resource