PT-2014-5099 · Elastic · Elasticsearch

Published 2014-07-28 · Updated 2026-01-03 · CVE-2014-3120

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.2

Description The default configuration in Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to the search endpoint. This issue only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Recommendations For versions prior to 1.2, consider disabling dynamic scripting to prevent the execution of arbitrary MVEL expressions and Java code. As a temporary workaround, restrict access to the search endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2014-3120

GHSA-MRFM-JXGF-2H6V

Affected Products

Elasticsearch

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/elasticsearch/script_mvel_rce.rb · Exploit
• 🔥 https://github.com/echohtp/ElasticSearch-CVE-2014-3120 · Exploit
• 🔥 http://exploit-db.com/exploits/33370 · Exploit
• 🔥 http://rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce · Exploit
• 🔥 https://exploit-db.com/exploits/33588 · Exploit
• 🔥 http://bouk.co/blog/elasticsearch-rce · Exploit
• 🔥 https://exploit-db.com/exploits/33370 · Exploit
• 🔥 https://found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch · Exploit
• 🔥 http://securityfocus.com/bid/67731 · Exploit
• https://elastic.co/blog/logstash-1-4-3-released · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrfm-jxgf-2h6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3120 · Security Note
• https://github.com/elastic/elasticsearch · Note
• https://github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12 · Note