# High risk on elasticsearch 9200/tcp Reported by Nessus

**URL:** <https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497>\
**Category:** Elasticsearch\
**Created:** [October 27, 2017, 1:44am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497 "2017-10-27T01:44:15Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiaodong.hu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaodong.hu/32/20370_2.png) [@xiaodong.hu](https://discuss.elastic.co/u/xiaodong.hu)\
**Post date:** [October 27, 2017, 1:44am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/1 "2017-10-27T01:44:15Z")

</div>

hello,  
I used Nessus to scan Elaticsearch (5.4.0),and there is one High risk on Elasticsearch:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a48d27c2b830f998a28a93aeedb57d86f1be8d3a.png)  
How can I fix it? thank you.

---

<div class="post-metadata">

**Author:** ![Ayra\_Faceless](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Ayra\_Faceless](https://discuss.elastic.co/u/Ayra_Faceless)\
**Post date:** [October 27, 2017, 1:50am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/2 "2017-10-27T01:50:51Z")

</div>

Interesting, could u pls provide more detail?

---

<div class="post-metadata">

**Author:** ![xiaodong.hu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaodong.hu/32/20370_2.png) [@xiaodong.hu](https://discuss.elastic.co/u/xiaodong.hu)\
**Post date:** [October 27, 2017, 3:03am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/3 "2017-10-27T03:03:11Z")

</div>

Sorry, I have no more detail. Just this report.

---

<div class="post-metadata">

**Author:** ![Ayra\_Faceless](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Ayra\_Faceless](https://discuss.elastic.co/u/Ayra_Faceless)\
**Post date:** [October 27, 2017, 7:41am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/4 "2017-10-27T07:41:34Z")

</div>

Yeah, i mean the full report in this screenshot

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 27, 2017, 9:02am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/5 "2017-10-27T09:02:31Z")

</div>

What version of Elasticsearch are you running?

---

<div class="post-metadata">

**Author:** ![xiaodong.hu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaodong.hu/32/20370_2.png) [@xiaodong.hu](https://discuss.elastic.co/u/xiaodong.hu)\
**Post date:** [October 27, 2017, 9:19am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/6 "2017-10-27T09:19:16Z")

</div>

5.4.0

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [October 27, 2017, 9:22am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/7 "2017-10-27T09:22:02Z")

</div>

Just out of curiosity, which java version is ES using? No idea if that would affect the result or not...

---

<div class="post-metadata">

**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\
**Post date:** [October 27, 2017, 1:28pm UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/8 "2017-10-27T13:28:16Z")

</div>

I spent some time looking at the Nessus test and reproducing it. The false positive appears to be the result of Elasticsearch returning the format string in its error message. For example:

```
➜ ~ nc localhost 9200
GET %#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x HTTP/1.1

HTTP/1.1 400 Bad Request
content-type: application/json; charset=UTF-8
content-length: 515

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"invalid escape sequence `%#0' at index 0 of: %#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"}],"type":"illegal_argument_exception","reason":"invalid escape sequence `%#0' at index 0 of: %#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"},"status":400}

```

As Elasticsearch is written in Java we are not vulnerable to traditional format string attacks. Elasticsearch deals with JSON for the input and output such false positives do pop up every now and then as the scanning vendors don't expect this behavior.

---

<div class="post-metadata">

**Author:** ![xiaodong.hu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaodong.hu/32/20370_2.png) [@xiaodong.hu](https://discuss.elastic.co/u/xiaodong.hu)\
**Post date:** [October 30, 2017, 5:59am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/9 "2017-10-30T05:59:07Z")

</div>

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 5:59am UTC](https://discuss.elastic.co/t/high-risk-on-elasticsearch-9200-tcp-reported-by-nessus/105497/10 "2017-11-27T05:59:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.