{"id":"CVE-2015-1427","kind":"vulnerability","aliases":["CVE-2015-1427"],"related":[],"title":"Elastic Elasticsearch: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","description":"The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Elasticsearch 1.3.0-1.3.7 and 1.4.0-1.4.2 let a crafted Groovy script escape the sandbox and run shell commands as the Elasticsearch JVM user. Fixed in 1.3.8 and 1.4.3, which turn off dynamic Groovy scripting by default. Only very old 1.x clusters are affected; 1.5 and later are not listed as affected.","severity":"critical","cvss":9.8,"epss":0.99906,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Elastic Elasticsearch","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Elasticsearch","fixed":["1.3.8","1.4.3"],"affected":">= 1.3.0, <= 1.3.7; >= 1.4.0, <= 1.4.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elasticsearch","exploited","groovy","package","rce","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Run GET / on the node to read version.number: 1.3.0-1.3.7 or 1.4.0-1.4.2 is affected. Then check config/elasticsearch.yml for script.groovy.sandbox.enabled: true or the old default of dynamic scripting on. Reachable port 9200 makes it remotely exploitable.","fix":"Upgrade to 1.3.8 or 1.4.3 or later. If you cannot upgrade, set script.groovy.sandbox.enabled: false in config/elasticsearch.yml and restart the node. Move trusted Groovy scripts to config/scripts on disk. Do not expose port 9200 to untrusted networks.","status":"open","published_at":"2015-02-17T15:59:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T21:21:50Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Elasticsearch to a release that includes the vendor fix or disable dynamic Groovy scripting; the sources do not name the fixed version.","reach":"network","impact":"high","summary":"Elasticsearch's Groovy scripting engine lets remote attackers escape the sandbox and run arbitrary shell commands on the server. CISA lists it as actively exploited in the wild, with an EPSS score of 0.999.","category":"package","who_cares":["elasticsearch","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary shell commands on the Elasticsearch server.","analyst_note":"Find the fixed Elasticsearch versions and the exact Groovy/dynamic scripting setting to check, from the Elastic advisory for CVE-2015-1427 (not in the sources given).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000476,"input_tokens":2847,"output_tokens":383,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed Elasticsearch versions and the exact Groovy/dynamic scripting setting to check, from the Elastic advisory for CVE-2015-1427 (not in the sources given).","search":"'-1427':13A,16A '-2015':12A,15A '1':67B '1.3.0':29B '1.3.7':30B '1.3.8':53B '1.4.0':32B '1.4.2':33B '1.4.3':55B '1.5':72B 'action':102C 'affect':71B,79B 'allow':86C 'appli':103C 'arbitrari':97C 'attack':88C 'bypass':90C 'cisa':100C 'cluster':69B 'code':8A 'command':45B,99C 'craft':36B 'cve':11A,14A 'default':63B 'dynam':59B 'elast':1A 'elastic':17A 'elasticsearch':2A,3A,18A,19A,20B,28B,48B,85C 'engin':6A,83C 'escap':39B 'execut':9A,96C 'exploit':21B 'fix':51B 'groovi':4A,22B,37B,60B,81C 'host':27B 'instruct':107C 'jvm':49B 'later':74B 'let':34B 'list':77B 'mechan':94C 'old':66B 'packag':23B 'per':105C 'protect':93C 'rce':24B 'remot':7A,87C 'requir':101C 'run':43B 'sandbox':41B,92C 'script':5A,38B,61B,82C 'self':26B 'self-host':25B 'shell':44B,98C 'turn':57B 'updat':104C 'user':50B 'vendor':106C 'vulner':10A 'x':68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-02-17T15:59:04+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-1427","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1427","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2015-1427","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1427","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2015-1427:71","url":null,"severity":null,"published_at":"2026-10-23T21:24:40+00:00","modified_at":"2026-10-23T21:24:40+00:00","first_seen_at":"2026-10-23T21:24:40+00:00","fetched_at":"2026-10-23T21:24:40+00:00","note":"Read Elastic's advisory (Bugtraq copy) and the GitHub fix issue; fixed 1.3.8 and 1.4.3. Elastic's blog URL did not return the post; no PoC page read, exploitation per CISA KEV."},{"source":"nvd","external_id":"CVE-2015-1427","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1427","severity":null,"published_at":"2015-02-17T15:59:04+00:00","modified_at":"2026-06-17T00:22:24+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":988,"url":"https://seclists.org/bugtraq/2015/Feb/92","title":"Elasticsearch vulnerability CVE-2015-1427 (Elastic, Bugtraq)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":989,"url":"https://github.com/elastic/elasticsearch/issues/9655","title":"Disable dynamic Groovy scripting by marking Groovy as not sandboxed","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":990,"url":"https://advisories.gitlab.com/maven/org.elasticsearch/elasticsearch/CVE-2015-1427/","title":"GitLab Advisory DB CVE-2015-1427","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}