elasticsearch default credentials

[omranisecurity]

Template Information:

Reference :
- https://www.alibabacloud.com/blog/what-is-the-default-username-and-password-for-elasticsearch_599610

Nuclei Template:

id: elasticsearch-default-credentials

info:
  name: elasticsearch default credentials
  author: Mohammad Reza Omrani | @omranisecurity
  severity: high
  description: Elasticsearch default credentials were discovered.
  reference: https://www.alibabacloud.com/blog/what-is-the-default-username-and-password-for-elasticsearch_599610
  tags: default-login, default-credentials, elasticsearch, elastic
  metadata:
    shodan-query:
      - http.title:"Elastic"
      - http.favicon.hash:1328449667
    max-request: 5

http:
  - raw:
      - |
        POST /internal/security/login HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows; Windows NT 10.1; Win64; x64; en-US) Gecko/20100101 Firefox/49.5
        Referer: {{BaseURL}}/login
        Content-Type: application/json
        kbn-version: 8.1.2
        x-kbn-context: %7B%22name%22%3A%22security_login%22%2C%22url%22%3A%22%2Flogin%22%7D
        Origin: {{BaseURL}}
        
        {"providerType":"basic","providerName":"basic","currentURL":"{{BaseURL}}/login","params":{"username":"{{username}}","password":"{{password}}" }}

    payloads:
      username:
        - elastic
      password:
        - changeme
    attack: pitchfork

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - 'Set-Cookie: sid='
          - 'kbn-license-sig:'

      - type: status
        status:
          - 200

[omranisecurity]

@princechaddha
How long does it take to check the template?

[DhiyaneshGeek]

Hi @omranisecurity i'm looking into this right now , should provide you in a min

Thanks !

[DhiyaneshGeek]

Hi @omranisecurity i have raised PR #7754 , could you share some information for setting up a vulnerable set-up like docker or set-up instructions

Thank you 😄