CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.
Upstream bug report: https://github.com/elasticsearch/elasticsearch/issues/9655
Upstream fixes: 1.3: https://github.com/elasticsearch/elasticsearch/commit/69735b0f4ab9ad7df4b82e8c917589b52cb9978c 1.4: https://github.com/elasticsearch/elasticsearch/commit/4e952b2d75de6ca4caf4b6743462714f3b60d07f 1.x: https://github.com/elasticsearch/elasticsearch/commit/716f0b24dc5414616e8dc0590dbfcfa0081be892
Mitigation: Users can address the vulnerability by setting script.groovy.sandbox.enabled to false in config/elasticsearch.yml and restarting the node.
Other sources
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
— CISA
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Elasticsearchto a version that resolves this vulnerability.Fixed in 1.3.8 - Upgrade
Upgrade
redhat/Elasticsearchto a version that resolves this vulnerability.Fixed in 1.4.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.3.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.3 - Configuration
Set script.groovy.sandbox.enabled to false in config/elasticsearch.yml and restart the node (as described in the provided mitigation for the Groovy scripting engine RCE issue).
Elasticsearch script.groovy.sandbox.enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1427?
CVE-2015-1427 has been classified with a high severity rating due to its potential for remote code execution.
How do I fix CVE-2015-1427?
To fix CVE-2015-1427, upgrade your Elasticsearch version to 1.3.8 or 1.4.3 or later.
Which versions of Elasticsearch are affected by CVE-2015-1427?
CVE-2015-1427 affects Elasticsearch versions prior to 1.3.8 and those in the 1.4.x series prior to 1.4.3.
Can CVE-2015-1427 allow remote attackers to execute commands?
Yes, CVE-2015-1427 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
Is there a workaround for CVE-2015-1427 if I can't upgrade?
There are no effective workarounds for CVE-2015-1427, so upgrading to a safe version is the only recommended solution.