41,554 blogs · 5,063,431 posts Claim your blog

Record · corpus.blog/posts/01a08790-88a4-70ec-b9f8-fd90de7f9ab3

Remote Code Execution in Elasticsearch - CVE-2015-1427

jordan-wright.com · published 8 March 2015

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jordan-wright.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 10
Words captured: 1,787

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

http://drops.wooyun.org/papers/5107

drops.wooyun.org

https://translate.google.com/translate?hl=en&sl=zh-CN&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F5107

translate.google.com

http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-scripting.html

elasticsearch.org

http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce

rapid7.com

http://www.elasticsearch.org/blog/scripting/

elasticsearch.org

https://github.com/elasticsearch/elasticsearch/blob/master/src/main/java/org/elasticsearch/script/groovy/GroovySandboxExpressionChecker.java

github.com

http://groovy.codehaus.org/api/org/codehaus/groovy/ast/expr/GStringExpression.html

groovy.codehaus.org

https://github.com/groovy/groovy-core/blob/0b2182bff2250150e69ccb988f367e709b4560de/src/main/org/codehaus/groovy/control/customizers/SecureASTCustomizer.java

github.com

http://docs.oracle.com/javase/tutorial/reflect/

docs.oracle.com

https://github.com/elasticsearch/elasticsearch/commit/68c4a6201e6c889b272c1b64550237fe6d172b47

github.com