CVE-2014-3120

Elasticsearch Remote Code Execution

8.1 HIGHActively exploited (CISA KEV)Public exploitEPSS 88.6%

Published28 Jul 2014
Added to CISA KEV25 Mar 2022
Remediation due15 Apr 2022

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Elastic Elasticsearch< 1.2.0

Remediation

Fixed in

Elastic Elasticsearch≥ 1.2.0

Patch & vendor advisories

References

http://bouk.co/blog/elasticsearch-rce/Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120US Government Resource
https://www.elastic.co/blog/logstash-1-4-3-releasedVendor Advisory
https://www.elastic.co/community/security/Vendor Advisory
https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearchExploit
http://www.exploit-db.com/exploits/33370Exploit
http://www.osvdb.org/106949Broken Link
http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rceExploitThird Party Advisory
http://www.securityfocus.com/bid/67731Exploit

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2014-3120 being actively exploited?

Yes. CVE-2014-3120 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022.

How severe is CVE-2014-3120?

CVE-2014-3120 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 88.6% probability of exploitation.

Which products are affected by CVE-2014-3120?

Affected products include Elastic Elasticsearch.

How do I fix CVE-2014-3120?

Upgrade affected software to a fixed version, for example Elastic Elasticsearch 1.2.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2014-3120 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.