# Exploitation

> RCE via Groovy script injection and sandbox escape on 1.x/2.x

- **URL:** https://hackindex.io/services/elasticsearch/exploitation
- **Service:** [Elasticsearch](https://hackindex.io/services/elasticsearch.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

Elasticsearch exploitation targets scripting engines and cluster features that were never designed to be internet-facing. Older versions with Groovy or MVEL scripting enabled allow arbitrary code execution through crafted search queries.

Snapshot restore abuse lets you overwrite indices with attacker-controlled data or plant backdoors in stored documents. Misconfigured clusters may also allow index deletion, alias hijacking, or plugin installation.

The subpages cover sandbox escape techniques, script execution via the search API, and snapshot-based attacks for persistence and data manipulation.

## Guides

- [Elasticsearch RCE via Groovy Script Injection](https://hackindex.io/services/elasticsearch/exploitation/elasticsearch-rce-via-groovy-script.md)