Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:MISC:ES-GROOVY-CODEEXEC |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
ElasticSearch Search Groovy Sandbox Bypass |
Release Date |
2015/06/09 |
Update Number |
2503 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: ElasticSearch Search Groovy Sandbox Bypass
This signature detects attempts to exploit a known vulnerability against ElasticSearch. A successful attack can lead to arbitrary code execution.
Extended Description
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected Products
- Elasticsearch elasticsearch 1.3.7
- Elasticsearch elasticsearch 1.4.0
- Elasticsearch elasticsearch 1.4.1
- Elasticsearch elasticsearch 1.4.2
References