CVE-2015-4165: High severity elastic elasticsearch vulnerability
All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify files read and executed by certain other applications. Upstream bug/commit unknown at the time of writing.
Mitigation: =========== Users should upgrade to 1.6.0. Alternately, ensure that other applications are not present on the system, or that Elasticsearch cannot write into areas where these applications would read.
External References:
https://www.elastic.co/community/security/
Other sources
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4165?
CVE-2015-4165 is categorized as a high severity vulnerability affecting multiple versions of Elasticsearch.
How do I fix CVE-2015-4165?
To mitigate CVE-2015-4165, users should upgrade Elasticsearch to version 1.6.0.
Which versions of Elasticsearch are affected by CVE-2015-4165?
CVE-2015-4165 affects all Elasticsearch versions from 1.0.0 to 1.5.2.
What type of attack does CVE-2015-4165 facilitate?
CVE-2015-4165 allows attackers to modify files that are read and executed by other applications using Elasticsearch.
Is there any alternative mitigation for CVE-2015-4165 besides upgrading?
Alternatively, users can ensure that other applications are properly secured to mitigate the risks associated with CVE-2015-4165.