Published: 17/08/2015 Updated: 09/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 506

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in Elasticsearch prior to 1.6.1 allows remote malicious users to read arbitrary files via unspecified vectors related to snapshot API calls.

Vulnerable Product	Search on Vulmon	Subscribe to Product
elasticsearch elasticsearch

Directory traversal vulnerability in Elasticsearch before 161 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls ...

# elasticpwn Script for ElasticSearch url path traversal vuln CVE-2015-5531 ``` [crg@fogheaven elasticpwn]$ python CVE-2015-5531py exploitlabint /etc/hosts !dSR script for CVE-2015-5531 127001 localhost # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff0 ...

CVE-2015-5531

CVE-2015-5531-POC 漏洞背景 Elasticsearch是荷兰Elasticsearch公司的一套基于Lucene构建的开源分布式RESTful搜索引擎，它主要用于云计算中，并支持通过HTTP使用JSON进行数据索引。 Elasticsearch 161之前版本中存在目录遍历漏洞。远程攻击者可借助快照的API调用利用该漏洞读取任意文件。使用说明 -u 指�

dirsearch

dirsearch2 dirsearch Bolt view page saurce ( its written on bolt) url/bolt admin – password file management – create filetxt enter - rename flagtxt to filephp go to file url = php?cmd=ls -l php?cmd=cat /flagtxt path traversal vulnerability Elastic Searchsploit elasticsearch 160 is our vulnerability, githubcom/nixawk/labs/blob/master/CVE-2015-5531/

cyber-sec-labs bolt Let's try: View Page Source, pay attantion to p This website is /p, add /bolt to url and guess the user and pass Once you are in you need to go to file management to see if you can upload some malicious files Let’s try to create and upload vulnerable rcehtml file click file and start editing Go to options and rename the rcehtml file to rce

nodiff backdoor $ dirsearch -u url found /backupzip download backup file $ wget url+/backupzip $ grep -r "shell_exec(" execute backdoor through vulnerable function browse url+/?welldone=knockknock&shazam=id find flag in source of page php unit $ dirsearch -u url found /composerjson browse url+/composerjson found php unit version look for vulnerability for

CWE-22 http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html https://www.elastic.co/community/security/http://www.securityfocus.com/bid/75935 http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html https://www.exploit-db.com/exploits/38383/http://www.securityfocus.com/archive/1/536017/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/38383/https://github.com/tutajorben/dirsearch2 https://access.redhat.com/security/cve/cve-2015-5531

CVE-2015-5531

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect