moch3n/cve-2015-5531-pocProof-of-concept exploit for CVE-2015-5531, a directory traversal vulnerability in Elasticsearch 1.6.1 and earlier, allowing remote file read via crafted API calls with automatic Unicode decoding.
Elasticsearch is an open-source, distributed RESTful search engine built on Lucene, developed by Elasticsearch B.V. in the Netherlands. It is primarily used in cloud computing and supports indexing data via HTTP using JSON. Versions of Elasticsearch prior to 1.6.1 contain a directory traversal vulnerability. Remote attackers can exploit this vulnerability to read arbitrary files by using the snapshot API call.
-u Specify the URL
-f Specify the file to read
This POC is a modified version of an existing one from the internet, which automatically performs Unicode decoding on the retrieved results. The code is relatively rough.
