Dungsocool/CVE-2014-3120

GitHubRepository PoCWriteup

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup analyzing and exploiting CVE-2014-3120 in Elasticsearch 1.1.1. The document describes the target environment, verifies the vulnerability, constructs an MVEL-based RCE payload, and demonstrates post-exploitation information gathering. It contains no executable exploit or scanner code, only curl commands and analysis.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file containing a lab write-up for exploiting CVE-2014-3120 against a local Elasticsearch 1.1.1 instance. The document describes reconnaissance, verification of dynamic scripting, and construction of an RCE payload using MVEL expressions. All described actions are consistent with normal exploitation of the stated CVE against the stated target. No concealed executable behavior, deceptive payloads, or operator-directed harm beyond the documented exploit are present.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdownbashjson
Target softwareElasticsearch
Attack typesremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical analysis and walkthrough of exploiting CVE-2014-3120. It describes the vulnerability, the target environment, and the steps to achieve RCE, but it does not provide any standalone executable code. The curl commands are illustrative examples within the narrative, not a functional exploit or scanner script. The analysis_routing classification is 'NO_POC_CODE_IDENTIFIED'.

README.md:1-431README.md:1

Requirements

  • Target must be running Elasticsearch version prior to 1.2 with dynamic scripting enabled.README.md:81
  • The Elasticsearch REST API must be accessible without authentication.README.md:66

Observed behavior

  • Sends a search request with a harmless MVEL script ('1+1') to confirm dynamic scripting is active.README.md:149-163
  • Sends a search request with a malicious MVEL script that executes the 'id' command via Java's Runtime.exec() and returns the output in the JSON response.README.md:202-218
  • Sends a search request with a malicious MVEL script that reads the '/etc/shadow' file and returns its contents.README.md:253-269
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Ip
192.168.3.137IP address of the target Elasticsearch instance used in the lab write-up.README.md:29
Target Port
9200Elasticsearch HTTP REST API port targeted in the exploit.README.md:48
Exploit Payload
import java.io.*; new java.util.Scanner(Runtime.getRuntime().exec("id").getInputStream()).useDelimiter("\\A").next();MVEL payload used to achieve remote code execution via Elasticsearch dynamic scripting.README.md:214
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the README.md file; 9 other non-text media files (images) are omitted, which may contain additional context.
  • The analysis is based on a lab environment and may not represent all real-world configurations.
  • Only the README.md text file was reviewed; 9 non-text media files (images) were omitted from the evidence and not inspected.
  • The review does not verify the accuracy or safety of the described exploit steps.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1