CVE-2015-1427

The Groovy scripting engine used by Elasticsearch for dynamic scripts (script fields, script-based sorting and queries) fails to properly confine user-supplied Groovy code, allowing a crafted script to escape the sandbox (CWE-284, improper access control) and invoke Java APIs such as Runtime to run arbitrary shell commands on the server. It is triggered remotely when an attacker who can reach the Elasticsearch HTTP API submits a malicious dynamic script (e.g., via the _search endpoint) on instances with dynamic scripting enabled. A successful attacker gains arbitrary command execution on the host running Elasticsearch, which can lead to full server compromise and follow-on activity such as malware or ransomware deployment. Affected deployments are Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 (per public advisory records; the CISA source data lists no explicit version range), with fixes shipped in 1.3.8 and 1.4.3. The flaw is confirmed exploited in the wild — CISA added it to the KEV catalog on 2022-03-25 with ransomware use unknown — and EPSS ranks it in the 100th percentile (99.9% probability of exploitation within 30 days), though no public PoC is listed in the source data.

What to do: Upgrade Elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later, consistent with CISA's required action to apply updates per vendor instructions; as an interim mitigation, disable dynamic Groovy scripting (script.dynamic: false) and restrict port 9200 to trusted networks. Inventory internet-exposed instances (Shodan/Censys on port 9200), verify installed versions via the cluster's root endpoint, and hunt for signs of command execution such as unexpected processes, new cron/systemd entries, or outbound connections from Elasticsearch hosts.