CVE-2014-3120: Elasticsearch Remote Code Execution Vulnerability

Vulnerability summary

CVE-2014-3120 is a high (CVSS 8.1) Improper Access Control vulnerability in Elastic Elasticsearch. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 88.56% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 7 public exploits are recorded.

Timeline

1. 28-07-2014
   PublishedVulnerability first disclosed.
2. 25-03-2022
   Added to CISA KEVElasticsearch Remote Code Execution Vulnerability
3. 15-04-2022
   CISA remediation dueApply updates per vendor instructions.
4. 22-10-2025
   Last modifiedVulnerability information updated.

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.