PT-2015-5280 · Elastic · Elasticsearch

Published 2015-02-17 · Updated 2025-05-31 · CVE-2015-1427

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 1.3.x through 1.3.7 Elasticsearch versions 1.4.x through 1.4.2

Description The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. This issue enables attackers to evade the sandbox protection and execute commands on the affected system.

Recommendations For Elasticsearch versions 1.3.x through 1.3.7, update to version 1.3.8 or later. For Elasticsearch versions 1.4.x through 1.4.2, update to version 1.4.3 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-1427

GHSA-W94P-6MHW-4QXW

Affected Products

Elasticsearch

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/elasticsearch/search_groovy_script.rb · Exploit
• 🔥 https://github.com/t0kx/exploit-CVE-2015-1427 · Exploit
• 🔥 http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/36337 · Exploit
• 🔥 https://exploit-db.com/exploits/36415 · Exploit
• https://access.redhat.com/errata/RHSA-2017:0868 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1427 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1427 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• http://elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1427 · Security Note
• https://osv.dev/vulnerability/GHSA-w94p-6mhw-4qxw · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1427 · Vendor Advisory
• http://securityfocus.com/bid/72585 · Note
• http://seclists.org/bugtraq/2015/Feb/92 · Note