CVE-2014-3120 Elasticsearch Remote Code Execution

What is CVE-2014-3120?

CVE-2014-3120 is a high-severity code injection vulnerability in Elastic Elasticsearch, published on 28 Jul 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Weakness: CWE-284

Which versions are affected by CVE-2014-3120?

2 open source packages ship an affected version, including org.elasticsearch:elasticsearch. It affects 1 product.

Products include Elastic Elasticsearch.

How do I fix CVE-2014-3120?

Upgrade org.elasticsearch:elasticsearch to 1.4.0.Beta1 or later. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2014-3120 being exploited?

Yes. Attackers have exploited CVE-2014-3120 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 5 proofs of concept on GitHub.

Other vulnerabilities in Elastic Elasticsearch

• CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution Exploited Critical 9.8
• CVE-2015-5377 Code injection in n/a Critical 9.8
• CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution High 8.8
• CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process High 8.8
• CVE-2020-7014 Privilege Escalation Flaw in Elasticsearch High 8.8

All Elastic Elasticsearch vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mrfm-jxgf-2h6v.