HTTP: ElasticSearch Search Groovy Sandbox Bypass

This signature detects attempts to exploit a known vulnerability against ElasticSearch. A successful attack can lead to arbitrary code execution.

Extended Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Affected Products

Redhat fuse

Short Name
HTTP:MISC:ES-GROOVY-CODEEXEC
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
Bypass CVE-2015-1427 ElasticSearch Groovy Sandbox Search bid:72585
Release Date
06/09/2015
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3724
False Positive
Unknown
Vendors

Redhat

Elastic

CVSS Score

7.5

Found a potential security threat?