.. / CVE-2021-22145

• Info Disclosure
• Nuclei
• Web

Exploit for Elasticsearch 7.10.0-7.13.3 - Information Disclosure (CVE-2021-22145)

Description:

ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as Elasticsearch documents or authentication details, thus potentially leading to data modification and/or execution of unauthorized operations.

Nuclei Template

View the template here CVE-2021-22145.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-22145.yaml

References: