# Critical Risk on Elasticsearch 9200 / tcp / www Reported by Nessus

**URL:** <https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603>\
**Category:** Elasticsearch\
**Created:** [May 22, 2017, 6:39am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603 "2017-05-22T06:39:58Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![caixiac1](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@caixiac1](https://discuss.elastic.co/u/caixiac1)\
**Post date:** [May 22, 2017, 6:39am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/1 "2017-05-22T06:39:58Z")

</div>

I used Nessus to scan Elaticsearch server, it reports there is one Critical risk on Elasticsearch issue:

Severity Plugin Id Name  
Critical (10.0) 10169 OpenLink Web Configurator GET Request Remote Overflow

For this OpenLink Web Configurator GET Request Remote Overflow, Nessus reports that:

Synopsis :The remote web server has an application that is affected by a bufferoverflow vulnerability.  
Description :It is possible to crash the remote web server by sending overly longGET requests. An attacker may exploit this issue to crash the remoteweb server or execute arbitrary code on the remote system.

Are there any analysis and planned solutions for this issue in the forum?  
.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d3fba82c15de9c464ce2a694ac8ed28d39c76ef.jpg)

Thanks!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 23, 2017, 2:25am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/2 "2017-05-23T02:25:37Z")

</div>

Hey

Thanks for opening this. Could you send your question to security (at) elastic (dot) co so folks can check and answer you directly?

In this email can you describe which API endpoint is concerned?

Thanks a lot

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 23, 2017, 3:04am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/3 "2017-05-23T03:04:13Z")

</div>

This appears to be related to this CVE [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0943](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0943).

But ES is not OpenLink, so I think this is a false positive.

---

<div class="post-metadata">

**Author:** ![caixiac1](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@caixiac1](https://discuss.elastic.co/u/caixiac1)\
**Post date:** [May 23, 2017, 6:54am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/4 "2017-05-23T06:54:22Z")

</div>

"OpenLink web config buffer overflow" is a type of issues when Nessus sends large GET requests to specific directory of web server and web server responded with non-NULL response. It's not necessarily related with OpenLink software. The following is source code of Nessus plugin 10169. Are there max-length message limitation for requests sent to Elasticsearch? Will it always process it? This is the issue why Nessus reports it.

[https://searchcode.com/codesearch/raw/39217884/](https://searchcode.com/codesearch/raw/39217884/)

# 

# This script was written by Renaud Deraison [deraison@cvs.nessus.org](mailto:deraison@cvs.nessus.org)

# 

# See the Nessus Scripts License for details

# 

if(description)  
{  
script\_id(10169);  
script\_version ("$Revision: 1.18 $");  
script\_cve\_id("CVE-1999-0943");  
name["english"] = "OpenLink web config buffer overflow";  
name["francais"] = "D閜assement de buffer dans la config web de OpenLink";  
script\_name(english:name["english"], francais:name["francais"]);

desc["english"] = "It is possible to make the remote server execute  
arbitrary code by sending one of these two URLs :

```
GET AAA[....]AAA
GET /cgi-bin/testcono?AAAAA[...]AAA HTTP/1.0

```

Solution : Upgrade.  
Risk factor : High";

desc["francais"] = "Il est possible de faire executer du code arbitraire  
au serveur en lui envoyant une des requ?tes :

```
GET AAAA[...]AAA
GET /cgi-bin/testcono?AAAAA[...]AAA HTTP/1.0

```

Solution : Mettez le ? jour.  
Facteur de risque : Elev�";

script\_description(english:desc["english"], francais:desc["francais"]);

summary["english"] = "OpenLink buffer overflow";  
summary["francais"] = "D閜assement de buffer dans OpenLink";  
script\_summary(english:summary["english"], francais:summary["francais"]);

script\_category(ACT\_DESTRUCTIVE\_ATTACK);

script\_copyright(english:"This script is Copyright (C) 1999 Renaud Deraison",  
francais:"Ce script est Copyright (C) 1999 Renaud Deraison");  
family["english"] = "Gain root remotely";  
family["francais"] = "Passer root ? distance";  
script\_family(english:family["english"], francais:family["francais"]);  
script\_dependencie("find\_service.nes", "httpver.nasl");  
script\_require\_ports(8000);  
script\_exclude\_keys("Settings/disable\_cgi\_scanning");  
exit(0);  
}

# 

# The script code starts here

# 

include("http\_func.inc");

port = 8000;  
if(get\_port\_state(port))  
{  
if(http\_is\_dead(port:port))exit(0);

data = http\_get(item:crap(4096), port:port);  
soc = http\_open\_socket(port);  
if(soc)  
{  
send(socket:soc, data:data);  
b = recv\_line(socket:soc, length:1024);  
http\_close\_socket(soc);  
if(!b){  
security\_hole(port);  
exit(0);  
}  
}  
else exit(0);

foreach dir (cgi\_dirs())  
{  
soc2 = http\_open\_socket(port);  
if(soc2)  
{  
data = http\_get(item:string(dir, "/testcono?", crap(2000)), port:port);  
send(socket:soc, data:data);  
c = recv\_line(socket:soc, length:1024);  
http\_close\_socket(soc);  
if(!strlen(c)){  
security\_hole(port);  
exit(0);  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 23, 2017, 7:13am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/5 "2017-05-23T07:13:41Z")

</div>

What version of ES are you on?

---

<div class="post-metadata">

**Author:** ![caixiac1](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@caixiac1](https://discuss.elastic.co/u/caixiac1)\
**Post date:** [May 23, 2017, 7:16am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/6 "2017-05-23T07:16:01Z")

</div>

We are in 2.4.1 now, are there max length limitation/configuration on incoming requests in later releases?  
We have plan to move to 5.2.1 in later releases.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 23, 2017, 7:19am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/7 "2017-05-23T07:19:29Z")

</div>

There is `http.max_content_length` [https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html), which defaults to 100 megs.

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [May 23, 2017, 7:26am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/8 "2017-05-23T07:26:12Z")

</div>

There is also `http.max_initial_line_length` which defaults to 4kB.

This report is bogus. You can't use a test built for openlink to test anything about elasticsearch. Just try the actual requests the script is sending and you'll see that you get back an error message until you pass the `max_initial_line_length`, after which you get back an empty response as Elasticsearch closes the connection

---

<div class="post-metadata">

**Author:** ![caixiac1](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@caixiac1](https://discuss.elastic.co/u/caixiac1)\
**Post date:** [May 23, 2017, 7:36am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/9 "2017-05-23T07:36:58Z")

</div>

> [@Clinton\_Gormley](#):
>
> This report is bogus. You can't use a test built for openlink to test anything about elasticsearch. Just try the actual requests the script is sending and you'll see that you get back an error message until you pass the max\_initial\_line\_length, after which you get back an empty response as Elasticsearch closes the connection

OK, thanks a lot for the input! It's quite helpful!  
If http.max\_content\_length is exceeded, will the connections be closed too?

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [May 23, 2017, 8:55am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/10 "2017-05-23T08:55:05Z")

</div>

Yes it will

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2017, 8:55am UTC](https://discuss.elastic.co/t/critical-risk-on-elasticsearch-9200-tcp-www-reported-by-nessus/86603/11 "2017-06-20T08:55:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.