CVE-2014-3120

CVE-2014-3120 is a remote code execution flaw in Elasticsearch that arises when dynamic scripting is enabled, allowing remote attackers to submit arbitrary MVEL expressions and Java code that the cluster evaluates. It is triggered by sending crafted requests to the Elasticsearch API of a cluster where dynamic scripts are permitted, which is the default configuration in legacy releases. An attacker gains arbitrary Java code execution on the server, which public reporting shows being used for cryptojacking, DDoS botnets, and worm-like propagation. Any Elastic Elasticsearch deployment with dynamic scripting enabled is affected. The flaw is listed in CISA KEV (added 2022-03-25), carries an 88.6% EPSS score, and recent honeypot and botnet reporting indicates multiple threat actors are actively exploiting exposed Elasticsearch clusters.

What to do: Apply updates per vendor instructions (the CISA KEV required action); current Elasticsearch releases no longer enable dynamic scripting by default, so upgrading removes the exposure. If upgrading is not immediately possible, disable dynamic scripting or restrict script execution, and limit exposure of the Elasticsearch API to trusted networks. Hunt for signs of compromise such as unexpected miner processes, outbound DDoS traffic, or worm-like lateral activity, since Talos honeypot data and WatchDog botnet reporting show this flaw being abused by multiple threat actors.