WaratekVRT Sign in

CVE-2015-1427 Elasticsearch

Affected softwareElasticsearch
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in1.3.8, 1.4.3
WeaknessImproper access control (CWE-284)
Published17 Feb 2015
Updated29 Sep 2026

Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 11 citations · honeypot sightings · 5 exploits · earliest 2019-04-09.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 8 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2015-03-11.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2015-1427 in VulnCheck (free account), which lists 6 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 799 days 2023-11-28 to 2026-11-12
Reported exploitation f5.com /labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-march-2019 2019-04-09
Reported exploitation fortinet.com /blog/threat-research/closer-look-satan-ransomwares-propagation-technics 2019-05-20
Reported exploitation cyware.com /news/satan-ransomware-an-overview-of-the-ransomwares-variants-and-exploits-35acecd3 2019-06-15
Reported exploitation trendmicro.com /en_us/research/19/g/multistage-attack-delivers-billgates-setag-backdoor-can-turn-elasticsearch-databases-into-ddos-botnet-zombies.html 2019-07-23
Reported exploitation digital.nhs.uk /cyber-alerts/2019/cc-3164 2019-07-25
Exploit reference VulnCheck XDB d7fc70b10203 Exploit type: info-leak 2022-02-24
Exploit reference VulnCheck XDB 3dcf28bea839 Exploit type: initial-access 2022-07-29
Exploit reference VulnCheck XDB 7c460955b63d Exploit type: initial-access 2023-12-21
Exploit reference VulnCheck XDB eea087566499 Exploit type: initial-access 2024-01-08
Exploit reference VulnCheck XDB 3c0329f35239 Exploit type: initial-access 2026-10-09

3 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Elasticsearch 1.4.0 < 1.4.2 Remote Code Execution exploit and vulnerable container 32 2017-01-09
GitHub PoC Vulhub elasticsearch/CVE-2015-1427: Elasticsearch 1.4.2 Groovy sandbox escape, run with Isoloom 2026-10-08
GitHub PoC To test elasticsearch vulnerabillity on newer version of debian 2024-11-10
GitHub PoC cve-2015-1427 2019-01-06
Exploit-DB ElasticSearch - Search Groovy Sandbox Bypass (Metasploit) 2015-03-16
Exploit-DB ElasticSearch - Remote Code Execution 2015-03-11
Nuclei ElasticSearch - Remote Code Execution
Metasploit ElasticSearch Search Groovy Sandbox Bypass (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule, ARMR Filesystem Write.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule, ARMR Filesystem Write

Groovy sandbox-bypass script injection via _search script_fields. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec most public exploits reach; a filesystem write rule on java.io.tmpdir blocks Metasploit's in-JVM JAR loader. A Groovy script that reads files or data directly in Java, without starting a program, is not stopped.

How to mitigate CVE-2015-1427

Upgrade Elasticsearch to a release that fixes it: 1.3.8 or 1.4.3. Until you can, Waratek RASP blocks exploitation with its process and filesystem rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.elasticsearch:elasticsearch 0 1.3.8 unbounded
org.elasticsearch:elasticsearch 1.4.0 1.4.3 unbounded

Products and versions

3 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd elastic elasticsearch generic ＜ 1.3.8 · ≥ 1.4.0 and ＜ 1.4.3
osv org.elasticsearch elasticsearch generic ＜ 1.3.8 · ≥ 1.4.0 and ＜ 1.4.3
nvd redhat fuse generic 1.0.0

References

URLTags
https://access.redhat.com/errata/RHSA-2017:0868 WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/100850 WEB
https://www.elastic.co/community/security WEB
http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html WEB
http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html WEB
http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released WEB
http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/534689/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72585 Broken Link, Third Party Advisory, VDB Entry
https://www.elastic.co/community/security/ Not Applicable, Vendor Advisory

Timeline
Published2015-02-17By the CVE Program.
VulnCheck KEV: earliest evidence2019-04-09Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-25Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
VulnCheck KEV: latest evidence2026-11-12Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.