Full Report
In Part 1, we went from a single open port to a complete map of the target. Version, topology, indices, secrets, credentials, privilege structure — all of it documented, all of it ready to be weaponized. Reconnaissance is finished. Now we find out what breaks.
Analysis Summary
# Vulnerability: Critical Legacy Script Injection in Elasticsearch
## CVE Details
- **CVE ID:** CVE-2014-3120
- **CVSS Score:** 8.1 (High)
- **CWE:** CWE-94 (Improper Control of Generation of Code) / CWE-74 (Injection)
## Affected Systems
- **Products:** Elasticsearch
- **Versions:** All versions prior to 1.2.0.
- **Configurations:** Systems where the MVEL scripting engine is enabled (default behavior in affected versions).
## Vulnerability Description
The vulnerability exists because Elasticsearch versions before 1.2.0 enabled the MVEL (MVFLEX Expression Language) scripting engine by default. This engine allows for the execution of arbitrary expressions via the `script_fields` parameter in search queries. Because these expressions are not properly sandboxed, an attacker can leverage Java reflection within the MVEL script to execute arbitrary shell commands on the host operating system with the privileges of the Elasticsearch process.
## Exploitation
- **Status:** PoC available; exploited in the wild. This vulnerability is currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Ability to read any file accessible by the ES process)
- **Integrity:** High (Ability to modify files or system configurations)
- **Availability:** High (Ability to crash the service or execute destructive commands)
## Remediation
### Patches
- Upgrade Elasticsearch to version **1.2.0** or later, where dynamic scripting is disabled by default.
### Workarounds
- For legacy systems that cannot be immediately upgraded, disable dynamic scripting by adding the following line to the `elasticsearch.yml` configuration file:
`script.disable_dynamic: true`
## Detection
- **Indicators of Compromise:**
- Search requests containing the `script_fields` parameter with Java-related syntax (e.g., `java.lang.Runtime.getRuntime().exec()`).
- Unexpected outbound network connections from the Elasticsearch node.
- **Detection methods and tools:**
- Use the **RAVEN** tool with the `--check-only` or `cve --list` flags to identify vulnerable instances.
- Monitor web application firewall (WAF) or SIEM logs for MVEL/Java injection patterns in JSON POST bodies.
## References
- LevelBlue SpiderLabs Blog: [https://www.levelblue[.]com/blogs/spiderlabs-blog/release-the-raven-exploiting-the-cracks]
- NVD CVE-2014-3120: [https://nvd.nist[.]gov/vuln/detail/CVE-2014-3120]
- CISA KEV Catalog: [https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog]