Elasticsearch Groovy Sandbox Bypass RCE

This is a deliberately vulnerable Elasticsearch training lab with valid exploit payloads documented in app/README.md and its Chinese translation, rather than a standalone automated exploit tool. The walkthrough creates an indexed document and submits a Groovy script_fields search request to escape the sandbox, execute id and return its output. It documents both a Java-reflection/Runtime technique and a direct Groovy execute() variant. CVE-2015-1427 is the target; CVE-2014-3120 appears only as historical context. The documentation identifies 1.3.8 and 1.4.3 as fixed releases, while the supplied lab specifically runs 1.4.2. The 33 files include vendored Vulhub walkthroughs and Compose configuration under app/, a Dockerfile, entrypoint and logging configuration under base/elasticsearch/1.4.2/, the central isoloom.yml specification, and generated deployment outputs under .isoloom/. These outputs support Docker, Kubernetes, Vagrant-hosted Docker, Proxmox-hosted Docker and six cloud providers: AWS, Azure, DigitalOcean, GCP, Linode and OCI. GitHub workflows validate and publish the lab. The 15 code/build/IaC files comprise seven Terraform files, one Ruby Vagrantfile, six shell scripts and one Dockerfile; YAML deployment files and workflow-embedded commands are additional infrastructure content. Groovy exploit code exists inside Markdown documentation. The checks verify HTTP availability, the reported 1.4.2 version and blocked Internet access; they do not exercise the sandbox bypass or prove successful exploitation. Docker isolation removes the target's default route, while Kubernetes uses network policies whose enforcement depends on the cluster networking implementation. Cloud firewalls restrict inbound SSH and published ports to an operator-provided CIDR, but Kubernetes supplies a LoadBalancer service with unrestricted source ingress on 9200 and 9300. The legacy app Compose file also publishes both ports without the generated isolation controls. No callback, exfiltration, persistence or container-escape mechanism is present. Cleanup commands in provisioning and CI have ordinary lab-management purposes and do not indicate a fake exploit. The default deployment pulls vulhub/elasticsearch:1.4.2 by tag; the vendored build recipe is not used automatically and relies on historical download sources. Analysis is static and does not establish runtime success. The original analyzed repository URL, analyzed git reference and archive size were not supplied; empty strings and zero represent unavailable metadata. The documented Vulhub commit 8fd63916f7a8711e2e01dda0d27237e4d6175d38 identifies upstream provenance, not the analyzed repository reference.

This repository contains a single Metasploit module targeting ElasticSearch servers vulnerable to CVE-2015-1427 (Groovy sandbox bypass, RCE). The exploit abuses the REST API (default port 9200) to send a specially crafted search request containing Groovy code, which bypasses the sandbox and allows arbitrary Java code execution. The module determines the target's OS and temporary directory, writes a base64-encoded Java payload (typically a Meterpreter shell) to a temporary file, and loads it via a URLClassLoader. The exploit is weaponized, allowing the attacker to select and deliver any Metasploit Java payload. The only code file is a Ruby Metasploit module, and the main attack vector is network-based, targeting the unauthenticated ElasticSearch REST API. The endpoints of interest are the REST API URL (http://<target>:9200/_search) and the temporary file path used for payload delivery.

This repository provides a proof-of-concept exploit for CVE-2015-1427, a remote code execution vulnerability in Elasticsearch versions 1.4.0 to 1.4.2. The repository includes a Dockerfile to set up a vulnerable Elasticsearch environment, a main.sh script to initialize the service and add sample data, and an exploit.sh script that performs the actual exploit. The exploit works by sending a specially crafted Groovy script via the Elasticsearch REST API (typically on port 9200), which bypasses the Groovy sandbox and executes arbitrary system commands (demonstrated with 'whoami'). The exploit does not require authentication and targets the default REST API endpoint. The repository is structured for easy testing and demonstration of the vulnerability, making it suitable for educational and research purposes.