Elasticsearch

Elasticsearch is a distributed search and analytics engine built on Apache Lucene. It listens on TCP 9200 for its REST API (HTTP) and TCP 9300 for internal cluster transport communication. Nmap typically identifies port 9200 as http or elasticsearch depending on the scan scripts used.

Exposed Elasticsearch instances are a top source of data breaches. By default, older versions ship without authentication, meaning anyone who can reach port 9200 can read, modify, or delete every index. Even when X-Pack security is enabled, weak credentials and misconfigured roles are common. Sensitive data such as logs, user records, and application data often ends up in indices with no access restrictions.

Enumeration begins with requesting the root endpoint (/) for version and cluster info, then listing indices via /_cat/indices. The /_search API allows querying all data. Cluster health, node info, and snapshot repositories reveal infrastructure details. Known vulnerabilities include Groovy and Painless script injection for remote code execution on unpatched versions.