CVEs / CVE-2014-3120
CVE-2014-3120: Elasticsearch Remote Code Execution Vulnerability
- Known exploited in the CISA KEV catalog since 25 Mar 2022
- high 8.1 CVSS 3.1 (NVD)
- EPSS 88.5% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2014-3120
Summary
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 25 Mar 2022 |
|---|---|
| Due date for US federal agencies | 15 Apr 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NScored by NVD |
|---|---|
| Weakness | CWE-284 |
References
- CVE-2014-3120 on NVD
- CVE-2014-3120 in the CISA KEV catalog
- http://bouk.co/blog/elasticsearch-rce/ Exploit
- http://www.exploit-db.com/exploits/33370 Exploit
- http://www.osvdb.org/106949 Broken Link
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/67731 Exploit
- https://www.elastic.co/blog/logstash-1-4-3-released Vendor Advisory
- https://www.elastic.co/community/security/ Vendor Advisory
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.