CVE-2014-3120

What it actually does

Enables remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search when dynamic scripting remains enabled in the default configuration.

Why it matters to the business

Attackers can gain control over the search server to read or alter data and disrupt operations; the vulnerability was added to the CISA KEV list with a 2022-04-15 remediation deadline and remains actively exploited in the wild.

How an attack unfolds

An attacker sends a crafted HTTP request to the _search endpoint containing malicious MVEL or Java code in the source parameter; the server evaluates and executes the code, allowing arbitrary command execution on the underlying system.

How to fix it

Upgrade all Elasticsearch instances to version 1.2 or later; alternatively set script.disable_dynamic: true in elasticsearch.yml and restart the service; restrict network access to Elasticsearch ports.

How to confirm the fix worked

Confirm elasticsearch.yml contains script.disable_dynamic: true or verify running version is 1.2+, then attempt a test search containing a script source parameter to ensure execution is blocked.

Typical attack path

1. Identify publicly reachable Elasticsearch instances on default ports
2. Craft and send a POST request to /_search containing executable code in the source field
3. Execute operating-system commands or Java payloads to establish a foothold
4. Exfiltrate data, install persistence mechanisms, or pivot to other systems

How to detect it

Search web-access or application logs for POST requests to paths containing _search that include the parameters script or source with code-like content; inspect for unusual Java or MVEL syntax in query bodies.

• POST /_search
• "script"
• "source"
• MVEL
• java.lang.Runtime

What your security team should do

• Immediately upgrade every Elasticsearch deployment to 1.2 or newer
• Place Elasticsearch behind a firewall or proxy and allow only trusted clients
• Enable query logging and alert on requests containing script or source parameters
• Review historical access logs for evidence of prior exploitation