CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution

What is CVE-2015-1427?

CVE-2015-1427 is a critical code injection vulnerability in Elastic Elasticsearch, published on 17 Feb 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Which versions are affected by CVE-2015-1427?

4 open source packages ship an affected version, including org.elasticsearch:elasticsearch. It affects 2 products.

Products include Elastic Elasticsearch, Redhat Fuse.

How do I fix CVE-2015-1427?

Upgrade org.elasticsearch:elasticsearch to a fixed version for your release line: 1.3.8 or 1.4.3. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2015-1427 being exploited?

Yes. Attackers have exploited CVE-2015-1427 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 6 proofs of concept on GitHub.

Other vulnerabilities in Elastic Elasticsearch

• CVE-2014-3120 Elasticsearch Remote Code Execution Exploited High 8.1
• CVE-2015-5377 Code injection in n/a Critical 9.8
• CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution High 8.8
• CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process High 8.8
• CVE-2020-7014 Privilege Escalation Flaw in Elasticsearch High 8.8

All Elastic Elasticsearch vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w94p-6mhw-4qxw.