CVE-2015-3337 PoC — Elasticsearch 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3337.yaml

Associated Vulnerability

Title:Elasticsearch 路径遍历漏洞 (CVE-2015-3337)
Description:Elasticsearch是荷兰Elasticsearch公司的一套基于Lucene构建的开源分布式RESTful搜索引擎，它主要用于云计算中，并支持通过HTTP使用JSON进行数据索引。 Elasticsearch 1.4.5之前版本和1.5.2之前1.5.x版本中存在目录遍历漏洞。当程序启用site插件时，远程攻击者可利用该漏洞读取任意文件。

Description

Elasticsearch before 1.4.5 and 1.5.x before 1.5.2 allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled.

File Snapshot


 id: CVE-2015-3337

info:
  name: Elasticsearch - Local File Inclusion
  author: pdteam
  severity: m

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!