CVE-2014-4326 Elasticsearch Logstash allows remote attackers to execute arbitrary commands
Remote attackers can execute arbitrary commands on Logstash servers via crafted events in Zabbix or Nagios output plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-4326?
CVE-2014-4326 is a high-severity command injection vulnerability in n/a, published on 22 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
Weakness: CWE-78
Which versions are affected by CVE-2014-4326?
2 open source packages ship an affected version, including logstash. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
logstash RubyGems | From 1.0.14 | 1.4.2 |
logstash RubyGems | From 1.0.14 | 1.4.2 |
Products include Elastic Logstash.
How do I fix CVE-2014-4326?
Upgrade logstash to 1.4.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-4326 being exploited?
There is no known exploitation of CVE-2014-4326 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-7612 Information disclosure in Logstash
- CVE-2023-46672 Logstash Insertion of Sensitive Information into Log File
- CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
- CVE-2019-7620 Denial of service in Logstash
- CVE-2015-5378 Information disclosure in n/a
Sources
Also known as GHSA-8qhq-rq4j-8prj.