Nuclei Template
View the template here CVE-2014-3120.yaml
Validate with Nuclei
echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2014/CVE-2014-3120.yaml
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Be aware this only violates the vendor’s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
View the template here CVE-2014-3120.yaml
echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2014/CVE-2014-3120.yaml
References:
http://bouk.co/blog/elasticsearch-rce/