The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers
    to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
    (CVE-2015-1427)

Elastic reports :

Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.

Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users that do not want to upgrade can address the vulnerability by setting script.groovy.sandbox.enabled to false in elasticsearch.yml and restarting the node.

The Elasticsearch application hosted on the remote web server is affected by a remote code execution vulnerability due to unspecified flaws in the Groovy script engine. A remote unauthenticated attacker, using a specially crafted request, can escape the sandbox and execute arbitrary Java code. A successful attack  could allow the user to gain a remote shell or manipulate files on the remote system.

ID	Name	Product	Family	Severity
419827	SCA: security update for org.elasticsearch:elasticsearch (GHSA-w94p-6mhw-4qxw)	Tenable Cloud Security	SCA Checks	critical
419827	SCA: security update for org.elasticsearch:elasticsearch (GHSA-w94p-6mhw-4qxw)	Tenable Self-Hosted Container Security	SCA Checks	critical
84409	FreeBSD : elasticsearch -- remote OS command execution via Groovy scripting engine (026759e0-1ba3-11e5-b43d-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
81816	Elasticsearch Groovy Script RCE	Nessus	CGI abuses	high

Detections

Analytics

CVE-2015-1427

critical

Tenable Plugins

critical

critical

high

high