Elasticsearch Site Plugin Directory Traversal Vulnerability
Description
A directory traversal vulnerability has been reported in Elasticsearch.
A remote attacker could exploit it via a specially crafted URL in order to retrieve arbitrary files from the server.
This vulnerability is exploitable only if a 'site plugin' is installed.
Updated, 01/05/2015:
A proof of concept is available.
Updated, 26/06/2015:
The elasticsearch packages provided by FreeBSD are vulnerable.
Updated, 03/07/2015:
An exploitation code is available in D2 Exploitation Pack.
Versions 1.5.2 and 1.4.5 of Elasticsearch fix this vulnerability.Workarounds for any site plugin:- set “http.disable_sites†to true and restart the Elasticsearch node- use a firewall or proxy to block HTTP requests to /_plugin- uninstall all site plugins from all Elasticsearch nodes.Updated, 29/04/2015:Fixed elasticsearch packages for Jessie 8 are available.
