CVE-2014-3120: Elasticsearch dynamic scripting allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with public exploit code and a very high EPSS score, and it yields remote code execution.

What it is

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, so the source parameter to _search can execute arbitrary MVEL expressions and Java code. This gives remote attackers a direct path to code execution on any instance left with default settings.

Impact

An attacker can run arbitrary MVEL expressions and Java code on the Elasticsearch server, leading to full compromise of the host process and its data. The CVSS vector shows high confidentiality and integrity impact with no availability impact.

Attack surface

Reached over the network through the _search endpoint's source parameter; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). The description notes the flaw only violates the vendor's intended security policy if Elasticsearch is not run in its own independent virtual machine.

Exploitation

CISA added this to KEV on 2022-03-25 with a due date of 2022-04-15, and EPSS shows a 30-day probability of 0.88559 (99.766th percentile). Multiple references are tagged Exploit, including Exploit-DB and a Rapid7 Metasploit module, so public exploit code exists.

What to do

• Upgrade Elasticsearch to 1.2 or later, where dynamic scripting is disabled by default.
• If upgrading is not immediately possible, disable dynamic scripting in the configuration.
• Restrict network access to the Elasticsearch HTTP/search port so only trusted hosts can reach it.
• Run Elasticsearch in an isolated environment or dedicated VM as the vendor intended.
• Review the cluster for unauthorized changes or unexpected processes.

Detection

• Monitor _search requests for a source parameter containing MVEL or Java code.
• Alert on Elasticsearch process spawning unexpected child processes or outbound connections.
• Audit Elasticsearch configuration for dynamic scripting being enabled.
• Check logs for anomalous search queries or errors tied to script execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.