What is Elasticsearch?
Elasticsearch is a distributed search and analytics engine, often used for logs and full-text search.
Common security issues
No authentication or TLS.
Exposed REST API.
Data leaks or indexing sensitive data.
Remote code execution via scripting.
Snapshot repository abuse.
Default ports
9200 – REST API
9300 – internal node communication
Enumeration
Covers REST API enum of auth, version, cluster, indices, mappings
Vulnerability Discovery
Guides for finding unauth access and exposed indices in Elasticsearch
Elasticsearch Unauthenticated Access and Data Exposure
Exploitation
RCE via Groovy script injection and sandbox escape on 1.x/2.x
Elasticsearch RCE via Groovy Script Injection
Data Exfiltration
Extract data from open Elasticsearch via scroll API and bulk export