CVE-2015-3337

This exploit leverages a directory traversal vulnerability in ElasticSearch plugins to read arbitrary files on the server. It checks for common plugins and attempts to retrieve specified files via crafted HTTP requests.

This PoC exploits a directory traversal vulnerability in ElasticSearch's 'head' plugin to read arbitrary files on the server. The script constructs a malicious URL path to bypass access controls and retrieve sensitive files like /etc/passwd.