Running Elasticsearch 1.4.2 or earlier? There's targeted malware going for your boxen

guest · Feb 27, 2019

Running Elasticsearch 1.4.2 or earlier? There's targeted malware going for your boxen
February 27, 2019
https://www.theregister.co.uk/2019/02/27/elasticsearch_malware_cisco_talos/

"These attackers are targeting clusters using versions 1.4.2 and lower," said the networking giant's infosec arm, Talos, in a post summarising what its honeypot setup had caught for examination.
Elasticsearch version 1.4.2 was first released in December 2014.

"These attacks leverage CVE-2014-3120 and CVE-2015-1427" said the security research outfit. [...] the 2015 flaw, which is specific to Elasticsearch's Groovy scripting engine "allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script".

"In terms of the payloads we've been able to characterise, we've seen denial of service attack payloads, compromised systems being routed into a DoS or a botnet being used for DoS. We also see cryptomining."
[...] its blog post goes into more detail [...]
Click to expand...

Log in or Sign up

Running Elasticsearch 1.4.2 or earlier? There's targeted malware going for your boxen

guest Guest

Log in or Sign up

Running Elasticsearch 1.4.2 or earlier? There's targeted malware going for your boxen

guest Guest

Useful Searches