Skip to content

Commit dfa61b3

Browse files
committed
A bit of description change
1 parent 7a29ae5 commit dfa61b3

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/exploits/multi/elasticsearch/script_mvel_rce.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ def initialize(info = {})
1616
'Name' => 'ElasticSearch Dynamic Script Arbitrary Java Execution',
1717
'Description' => %q{
1818
This module exploits a remote command execution vulnerability in ElasticSearch,
19-
exploitable by default on ElasticSearch prior to 1.2.0. The problem exists on
20-
the REST API, accessible without authentication, neither authorization, where
21-
the search function allows for dynamic scripts execution, which allows remote
22-
attackers to execute arbitrary Java code. This module has been tested successfully
23-
on ElasticSearch 1.1.1 on Ubuntu Server 12.04 and Windows XP SP3.
19+
exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the
20+
REST API, which requires no authentication or authorization, where the search
21+
function allows dynamic scripts execution, and can be used for remote attackers
22+
to execute arbitrary Java code. This module has been tested successfully on
23+
ElasticSearch 1.1.1 on Ubuntu Server 12.04 and Windows XP SP3.
2424
},
2525
'Author' =>
2626
[

0 commit comments

Comments
 (0)