From a483b4aafc7e2330acbd39e57caa8ed0a7726be8 Mon Sep 17 00:00:00 2001 From: MarketingYeti <77474444+MarketingYeti@users.noreply.github.com> Date: Fri, 26 Feb 2021 09:51:30 -0500 Subject: [PATCH] docs: Update ElasticGroovy.md --- docs/content/reference/exploiters/ElasticGroovy.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/content/reference/exploiters/ElasticGroovy.md b/docs/content/reference/exploiters/ElasticGroovy.md index 7325ccb86..86ae4247c 100644 --- a/docs/content/reference/exploiters/ElasticGroovy.md +++ b/docs/content/reference/exploiters/ElasticGroovy.md @@ -4,9 +4,10 @@ date: 2020-07-14T08:41:40+03:00 draft: false tags: ["exploit", "windows", "linux"] --- +### Description -CVE-2015-1427. +CVE-2015-1427 -> The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. +> The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x (before 1.4.3) allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. -Logic is based on [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/12198a088132f047e0a86724bc5ebba92a73ac66/modules/exploits/multi/elasticsearch/search_groovy_script.rb). +The logic is based on the [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/12198a088132f047e0a86724bc5ebba92a73ac66/modules/exploits/multi/elasticsearch/search_groovy_script.rb).