Description
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
ElasticSearch Search Groovy Sandbox Bypass
exploit/multi/elasticsearch/search_groovy_script
Exploit-DB 2
- ElasticSearch - Search Groovy Sandbox Bypass (Metasploit) EDB-36415 · remote · Mar 16, 2015 · verified
- ElasticSearch - Remote Code Execution EDB-36337 · remote · Mar 11, 2015 · verified
GitHub 6 repositories
-
t0kx/exploit-CVE-2015-1427 ★ 32 · Jan 9, 2017
Elasticsearch 1.4.0 < 1.4.2 Remote Code Execution exploit and vulnerable container
-
CyberCTF/vulhub-elasticsearch-cve-2015-1427 ★ 0 · Oct 8, 2026
Vulhub elasticsearch/CVE-2015-1427: Elasticsearch 1.4.2 Groovy sandbox escape, run with Isoloom
-
Sebikea/CVE-2015-1427-for-trixie ★ 0 · Nov 10, 2024
To test elasticsearch vulnerabillity on newer version of debian
-
xpgdgit/CVE-2015-1427 ★ 0 · Jul 29, 2022
-
cyberharsh/Groovy-scripting-engine-CVE-2015-1427 ★ 0 · Jun 22, 2020
-
cved-sources/cve-2015-1427 ★ 0 · Jan 6, 2019
cve-2015-1427
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ElasticSearch - Remote Code Execution http/cves/2015/CVE-2015-1427.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | < 1.3.8 | 1.3.8 | GHSA-w94p-6mhw-4qxw |
| Maven | org.elasticsearch:elasticsearch | >= 1.4.0, < 1.4.3 | 1.4.3 | GHSA-w94p-6mhw-4qxw |
Advisories 1
- WID-SEC-2025-2233 Elasticsearch: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Oct 8, 2025
References
- 20150211 Elasticsearch vulnerability CVE-2015-1427 mailing-list
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- RHSA-2017:0868 vendor-advisory
- 72585 vdb-entry
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
- elasticsearch-cve20151427-command-exec(100850) vdb-entry
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- https://www.elastic.co/community/security/