漏洞描述
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120↗www.elastic.cohttps://www.elastic.co/blog/logstash-1-4-3-released↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2014-3120↗bouk.cohttp://bouk.co/blog/elasticsearch-rce/↗www.elastic.cohttps://www.elastic.co/community/security/↗