Skip to content

Fix elasticsearch traversal check support - #21344

Merged
adfoster-r7 merged 1 commit into
rapid7:masterfrom
adfoster-r7:fix-elasticsearch-traversal-check-support
Apr 21, 2026
Merged

Fix elasticsearch traversal check support#21344
adfoster-r7 merged 1 commit into
rapid7:masterfrom
adfoster-r7:fix-elasticsearch-traversal-check-support

Conversation

@adfoster-r7

@adfoster-r7 adfoster-r7 commented Apr 21, 2026

Copy link
Copy Markdown
Contributor

Fixes the check method for scanner/http/elasticsearch_traversal

Verification

Before:

msf auxiliary(scanner/http/elasticsearch_traversal) > check rhost=127.0.0.1
[*] 127.0.0.1:9200 - This module does not support check.

Check code bug fix:

msf auxiliary(scanner/http/elasticsearch_traversal) > check 127.0.0.1
[-] Auxiliary failed: NoMethodError undefined method `body' for nil
[-] Call stack:
[-]   /Users/user/Documents/code/metasploit-framework/modules/auxiliary/scanner/http/elasticsearch_traversal.rb:63:in `check_host'
[-]   /Users/user/Documents/code/metasploit-framework/lib/msf/core/auxiliary/multiple_target_hosts.rb:23:in `check'
[-] 127.0.0.1:9200 - Check failed: The state could not be determined.

Module bug fix:

msf auxiliary(scanner/http/elasticsearch_traversal) > recheck 127.0.0.1
[*] Reloading module...
[*] 127.0.0.1:9200 - Cannot reliably check exploitability. Failed to connect to the target.

Vuln target:

msf auxiliary(scanner/http/elasticsearch_traversal) > check 10.140.113.233
[*] 10.140.113.233:9200 - The target appears to be vulnerable. Successfully created snapshot repositories, suggesting the Snapshot API is vulnerable to CVE-2015-5531.

@adfoster-r7

Copy link
Copy Markdown
Contributor Author

Release notes

Fixes a bug when running the check method for scanner/http/elasticsearch_traversal against non-vulnerable targets

nmod = replicant
begin
nmod.check_host(datastore['RHOST'])
rescue NoMethodError

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was hiding real check attempts failing

@github-project-automation github-project-automation Bot moved this from Todo to In Progress in Metasploit Kanban Apr 21, 2026
@adfoster-r7
adfoster-r7 merged commit a918184 into rapid7:master Apr 21, 2026
48 of 49 checks passed
@adfoster-r7
adfoster-r7 deleted the fix-elasticsearch-traversal-check-support branch April 21, 2026 14:57
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Apr 21, 2026
@adfoster-r7

Copy link
Copy Markdown
Contributor Author

Release Notes

Fixes a bug that incorrectly marked modules not having a check method present when targeting non-vulnerable targets in some scenarios. Also improves the check method for scanner/http/elasticsearch_traversal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rn-fix release notes fix

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

3 participants