CVE-2015-1427

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

Elasticsearch

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

17. Feb 2015

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/errata/RHSA-2017:0868
• Hersteller
  http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
• Hersteller
  https://www.elastic.co/community/security/
• Hinweis
  http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
• Hinweis
  http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
• Hinweis
  http://www.securityfocus.com/archive/1/534689/100/0/threaded
• Hinweis
  http://www.securityfocus.com/bid/72585
• Hinweis
  https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427
• CISA
  Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
• NVD
  CVE-2015-1427