pentesting-elasticsearch

name	pentesting-elasticsearch
description	Testing Elasticsearch search/analytics clusters (default HTTP port 9200, transport 9300) for disabled authentication and full index dumping, default/weak credentials, write access to indices, and the historical Groovy/MVEL dynamic-scripting remote-code-execution CVEs (CVE-2015-1427, CVE-2014-3120) during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","database","elasticsearch"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting Elasticsearch (port 9200)

When to Use

• Default 9200/tcp (REST/HTTP API), 9300/tcp (node-to-node transport).
• Accessed over HTTP — browsing http://<IP>:9200/ returns a JSON banner (cluster name, version, Lucene version).
• Use whenever 9200 is reachable — Elasticsearch ships with authentication disabled by default, exposing all indices.

Quick Enumeration

# Banner / version
curl -s http://<IP>:9200/

# Auth posture check
curl -s -X GET "http://<IP>:9200/_xpack/security/user"
# 500 "Security must be explicitly enabled" => auth DISABLED (open)
# 401 "missing authentication credentials" => auth ENABLED (need creds)

nmap -sV -p9200 --script http-* <IP>
msfconsole -q -x 'use auxiliary/scanner/elasticsearch/indices_enum; set RHOSTS <IP>; run; exit'

Critical: Checks Most Often Missed

• Authentication disabled (default) → full index dump — the #1 miss. Without X-Pack security, every index and document is world-readable.
  • How to CONFIRM: curl http://<IP>:9200/ returns the banner and curl http://<IP>:9200/_cat/indices?v lists indices. The _xpack/security/user 500 error confirms security is off.
• Default / weak credentials (when auth on) — HTTP basic auth with defaults: elastic (superuser), kibana, logstash_system, beats_system, remote_monitoring_user, apm_system; old versions default password changeme.
  • How to CONFIRM: curl http://elastic:changeme@<IP>:9200/ returns data; brute force via any HTTP-basic tool.
• Write access to indices — an unauthenticated/over-privileged instance may allow creating/modifying documents (data tampering, stored XSS into dashboards).
  • How to CONFIRM: curl -X POST '<IP>:9200/bookindex/books' -H 'Content-Type: application/json' -d '{"a":"b"}' succeeds and the new index appears in _cat/indices.
• Dynamic scripting RCE (legacy clusters) — old versions allow server-side script execution leading to RCE: