Vulnerability Details : CVE-2015-1427
Public exploit exists!
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Products affected by CVE-2015-1427
- cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
Threat overview for CVE-2015-1427
Top countries where our scanners detected CVE-2015-1427
Top open port discovered on systems with this issue
9200
IPs affected by CVE-2015-1427 24
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-1427!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
CVE-2015-1427 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2015-1427
Added on
2022-03-25
Action due date
2022-04-15
Exploit prediction scoring system (EPSS) score for CVE-2015-1427
97.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2015-1427
-
ElasticSearch Search Groovy Sandbox Bypass
Disclosure Date: 2015-02-11First seen: 2020-04-26exploit/multi/elasticsearch/search_groovy_scriptThis module exploits a remote command execution (RCE) vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.4.3. The bug is found in the REST API, which does not require authentication, where the search function allows groovy code executi
CVSS scores for CVE-2015-1427
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | 2024-07-16 |
References for CVE-2015-1427
-
http://www.securityfocus.com/bid/72585
Elasticsearch Groovy Scripting Engine Sandbox Security Bypass VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
Elasticsearch 1.4.3 and 1.3.8 Released | Elastic BlogPatch;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2017:0868
RHSA-2017:0868 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
Elasticsearch 1.3.7 / 1.4.2 Sandbox Escape / Command Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/archive/1/534689/100/0/threaded
SecurityFocusBroken Link;Third Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
ElasticSearch Unauthenticated Remote Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.elastic.co/community/security/
Elastic Stack Security Disclosures · Report Issues | ElasticNot Applicable;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
Elasticsearch Groovy scripting engine command execution CVE-2015-1427 Vulnerability ReportThird Party Advisory;VDB Entry
Jump to