Ethical Hacking Automation

Automate Recon and scanning process with Vidoc. All security teams in one place

ElasticSearch Information Disclosure

By kannthu

Vidoc logoVidoc Module

What is the "ElasticSearch Information Disclosure?"

The "ElasticSearch Information Disclosure" module is designed to detect potential information disclosure vulnerabilities in ElasticSearch, a popular search and analytics engine. This module focuses on identifying misconfigurations that could lead to sensitive data being exposed. The severity of this vulnerability is classified as low.

Original author(s): Shine, c-sh0, geeknik


If the ElasticSearch Information Disclosure vulnerability is present, it could allow unauthorized access to sensitive information stored in the ElasticSearch database. This could potentially lead to the exposure of confidential data, such as user credentials, personal information, or proprietary business data.

How the module works?

The module works by sending specific HTTP requests to the target ElasticSearch instance and analyzing the responses for indicators of information disclosure. It checks for the presence of certain keywords in the response body, headers, and the HTTP status code to determine if the vulnerability exists.

Example HTTP request:

GET /?pretty

The module uses the following matching conditions:

- Check if the response contains any of the following keywords: "took":, "number" :, "number_of_nodes" - Check if the response headers indicate one of the following content types: application/json, application/vnd.api+json, text/plain - Check if the HTTP status code is 200

If all the matching conditions are met, the module reports the vulnerability, indicating a potential information disclosure issue in the ElasticSearch instance.

Concurrent Requests (1)
1. HTTP Request template
GET/?pretty/_cat/indices?v/_all/_search(+1 paths)
Matching conditions
word: "took":, "number" :, "number_of_nodes"and
word: application/json, application/vnd.api+js...and
status: 200
Passive global matcher
No matching conditions.
On match action
Report vulnerability