ZeroDay Findings
Sign inSign up

Findings

CVE-2015-1427

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

Published Feb 17, 2015 · updated Jun 16, 2026 · n/a n/a

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 17, 2015 · Catalog

    Detected

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe elastic/elasticsearchversion unspecified
  • cpe redhat/fuse1.0.0
  • vendor Elastic Elasticsearchversion unspecified
  • vendor n/a n/aversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2015-1427

    The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2015-1427

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2015-1427

    30-day exploitation probability 99.9%

    first.org
  • Exploit DatabasePublic exploit reference36337

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference36415

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/elasticsearch/search_groovy_script

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2015-1427

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References