Description
Elasticsearch用的脚本引擎是MVEL，该引擎的默认配置打开了动态脚本功能，导致攻击者可以利用工具执行任意代码。
Elasticsearch 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2015-1427
https://github.com/hmiaooo/WooYun/blob/master/ElasticSearch%20Groovy%E8%84%9A%E6%9C%AC%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%EF%BC%88CVE-2015-1427%EF%BC%89.html
https://blog.csdn.net/GG_BOND01/article/details/150918356
https://blog.nsfocus.net/elasticsearch-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%EF%BC%88cve-2015-1427%EF%BC%89%E9%AB%98%E7%BA%A7%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95/
https://developer.aliyun.com/article/6089
https://stack.chaitin.com/vuldb/detail/8df50ac1-428e-4912-b8cc-c1c01848e0dc
https://www.cnblogs.com/TWX521/p/17916224.html
https://iswin.org/2015/03/04/Elasticsearch-Groovy-remote-code-execution/
https://www.exploit-db.com/exploits/33370
https://jordan-wright.com/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/
https://www.rapid7.com/db/modules/exploit/multi/elasticsearch/search_groovy_script/