4 ms·
This is old. There are bots that scan servers for ES and try to exploit this vulnerability. Our servers were hacked through this hole before we upgraded to a ne
by skua 11y ago
This is old. There are bots that scan servers for ES and try to exploit this vulnerability. Our servers were hacked through this hole before we upgraded to a newer version of ES.
Now we don't allow remote access to ES directly. We use a proxy script that parses HTTP requests from users, interacts with local ES instance and serves users with transformed data.
- MichaelGG 11y agoHow did you have it open to the Internet? Couldn't someone just DELETE everything? Or what kind of setup/restriction did you have?
- skua 11y agoIt was served through a proxy script, but actual ES instance was accessible to anyone and yes anyone could delete documents, groovy dynamic scripting was also enabled. Stupid setup I know... Our documents were not touched, but our servers were used to ddos something.
- juliangregorian 11y agoI've gotten this too. It started DOSing ip addresses in China, which is a pretty funny thing for elasticsearch to be able to do. Lesson learned: don't expose elasticsearch directly to the internet; even though it is a REST server, it was never designed for that. At the very least take 10 minutes to write an nginx proxy around it.