CVE-2014-3120

elasticsearch

Published 28 Jul 2014 · updated 17 Jun 2026 · Analyzed

8.1 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

References

bouk.co/blog/elasticsearch-rce/ · Exploit
www.exploit-db.com/exploits/33370 · Exploit
www.osvdb.org/106949 · Broken Link
www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce · Exploit, Third Party Advisory
www.securityfocus.com/bid/67731 · Exploit
www.elastic.co/blog/logstash-1-4-3-released · Vendor Advisory
www.elastic.co/community/security/ · Vendor Advisory
www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch · Exploit
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120 · US Government Resource