{"id":"CVE-2014-3120","kind":"vulnerability","aliases":["CVE-2014-3120"],"related":[],"title":"Elastic Elasticsearch: Elasticsearch Remote Code Execution Vulnerability","description":"The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.","summary":"Elasticsearch before 1.2.0 enables dynamic scripting by default, so anyone who can reach the HTTP API (port 9200) can send a _search request with a script in the source parameter and run MVEL/Java code on the host. Exploited in the wild (CISA KEV). Elastic's own mitigation is to put the cluster behind a firewall, not run as root, and disable dynamic scripting.","severity":"critical","cvss":8.1,"epss":0.88559,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Elastic Elasticsearch","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Elasticsearch","fixed":["1.2.0","1.4.0.Beta1"],"affected":"< 1.2.0 (NVD); < 1.4.0.Beta1 (GHSA)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elasticsearch","exploited","package","rce","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Run GET http://<host>:9200/ and read version.number: below 1.2.0 is vulnerable by default. 1.2.x-1.3.x are default-off but vulnerable if elasticsearch.yml sets script.disable_dynamic: false; GHSA treats anything below 1.4.0.Beta1 as affected. Check that ports 9200/9300 are not reachable from untrusted networks. Look for Runtime.getRuntime().exec errors in Elasticsearch logs, /boot/.iptables, modified /etc/init.d scripts and abnormal load.","fix":"Upgrade to 1.2.0 or later (dynamic scripting off by default); 1.4.0.Beta1 or later per GHSA, and in practice any currently supported release. If you cannot upgrade, add script.disable_dynamic: true to elasticsearch.yml and restart every node. Firewall ports 9200 and 9300 and do not run as root. If you find signs of compromise, reinstall the host.","status":"open","published_at":"2014-07-28T19:55:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:22:08Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Elastic's instructions; the fixed version is unknown from the sources. Disable dynamic scripting in elasticsearch.yml if the update cannot be applied; the exact setting is unknown from the sources.","reach":"network","impact":"high","summary":"Elasticsearch has dynamic scripting enabled, so a remote attacker can run arbitrary MVEL expressions and Java code on the server. The attacker gets code execution on the host running the cluster.","category":"package","who_cares":["elasticsearch","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary Java code on the Elasticsearch server.","analyst_note":"Find the affected and fixed Elasticsearch versions and the dynamic scripting setting to disable, from the Elastic advisory linked via the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3120).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":2828,"output_tokens":432,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Elasticsearch versions and the dynamic scripting setting to disable, from the Elastic advisory linked via the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3120).","search":"'-2014':9A,12A '-3120':10A,13A '1.2':93C '1.2.0':26B '9200':41B 'allow':98C 'anyon':33B 'api':39B 'arbitrari':103C 'attack':100C 'behind':76B 'cisa':65B 'cluster':75B 'code':5A,57B,108C 'configur':89C 'cve':8A,11A 'default':31B,88C 'disabl':84B 'dynam':28B,85B,95C 'elast':1A,67B 'elastic':14A 'elasticsearch':2A,3A,15A,16A,17B,24B,91C,131C 'enabl':27B,94C 'execut':6A,102C 'exploit':18B,61B 'express':105C 'firewal':78B 'host':23B,60B 'http':38B 'independ':135C 'intend':122C 'java':107C 'kev':66B 'machin':137C 'mitig':70B 'mvel':104C 'mvel/java':56B 'note':115C 'packag':19B 'paramet':53B,112C 'polici':124C 'port':40B 'put':73B 'rce':20B 'reach':36B 'remot':4A,99C 'request':46B 'root':82B 'run':55B,80B,130C 'script':29B,49B,86B,96C 'search':45B,114C 'secur':123C 'self':22B 'self-host':21B 'send':43B 'sourc':52B,111C 'user':127C 'vendor':120C 'via':109C 'violat':118C 'virtual':136C 'vulner':7A 'wild':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-07-28T19:55:04+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-3120","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3120","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2014-3120","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3120","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2014-3120:66","url":null,"severity":null,"published_at":"2026-10-23T21:23:39+00:00","modified_at":"2026-10-23T21:23:39+00:00","first_seen_at":"2026-10-23T21:23:39+00:00","fetched_at":"2026-10-23T21:23:39+00:00","note":"Read Elastic's 2014-07-09 blog (vendor primary; no standalone ESA found), NVD and GHSA. Affected range differs: NVD/Elastic say dynamic scripting default-off from 1.2.0; GHSA says <1.4.0.Beta1 (MVEL replaced by Groovy). Actively exploited since 2014 (KEV); Elastic describes in-the-wild attacks. No PoC link read."},{"source":"nvd","external_id":"CVE-2014-3120","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3120","severity":null,"published_at":"2014-07-28T19:55:04+00:00","modified_at":"2026-06-17T00:07:37+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":972,"url":"https://www.elastic.co/blog/scripting-security","title":"Scripting and Security (Elastic, 2014-07-09)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":975,"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3120","title":"NVD CVE-2014-3120","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":976,"url":"https://github.com/advisories/GHSA-mrfm-jxgf-2h6v","title":"GHSA-mrfm-jxgf-2h6v","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}