Elasticsearch is prone to a remote-code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code

Ask the vendor for an update or disable 'dynamic scripting'

Elasticsearch has a flaw in its default configuration which makes it possible for any webpage to execute arbitrary code on visitors with Elasticsearch installed.

Elasticsearch < 1.2

Send a special crafted HTTP GET request and check the response

• http://bouk.co/blog/elasticsearch-rce/

---

Updated on 2015-03-25