It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.

Upstream bug report: https://github.com/elasticsearch/elasticsearch/issues/9655

Upstream fixes: 1.3: https://github.com/elasticsearch/elasticsearch/commit/69735b0f4ab9ad7df4b82e8c917589b52cb9978c 1.4: https://github.com/elasticsearch/elasticsearch/commit/4e952b2d75de6ca4caf4b6743462714f3b60d07f 1.x: https://github.com/elasticsearch/elasticsearch/commit/716f0b24dc5414616e8dc0590dbfcfa0081be892

Mitigation: Users can address the vulnerability by setting script.groovy.sandbox.enabled to false in config/elasticsearch.yml and restarting the node.

Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3120 to the following vulnerability:

Name: CVE-2014-3120 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3120 Assigned: 20140429 Reference: EXPLOIT-DB:33370 Reference: http://www.exploit-db.com/exploits/33370 Reference: http://bouk.co/blog/elasticsearch-rce/ Reference: http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/scriptmvelrce Reference: https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch Reference: http://www.securityfocus.com/bid/67731 Reference: OSVDB:106949 Reference: http://www.osvdb.org/106949

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

As noted in <http://bouk.co/blog/elasticsearch-rce/>, adding "script.disabledynamic: true" to elasticsearch.yml, and ensuring Elasticsearch only binds to localhost, can help mitigate this issue.