CVE Exploitation

This article demonstrates RAVEN, an Elasticsearch and Kibana exploitation framework, against deliberately vulnerable lab environments. RAVEN tracks 8 Elastic-specific CVEs and provides working exploits for 6 of them, including root-level RCE via MVEL script injection (CVE-2014-3120), Groovy sandbox bypass via Java reflection (CVE-2015-1427), and arbitrary file read via Snapshot API directory traversal (CVE-2015-5531). The framework also includes version-based detection without exploitation for CVE-2020-7009/7014 (API key privilege escalation) and a scripting module that abuses legitimate Elasticsearch scripting functionality when valid credentials are available.

LevelBlue SpiderLabs has released RAVEN, an open-source offensive security framework with 19 modules targeting Elasticsearch and Kibana environments. The tool automates reconnaissance, credential brute-forcing, exploitation of 8 tracked CVEs (three in CISA's KEV catalog, CVSS up to 10.0), Kibana-specific attacks, data exfiltration, and persistence via rogue users and long-lived API keys. Defenders should treat the release of this tool as an indicator that adversaries now have a consolidated, purpose-built toolkit for attacking exposed Elasticsearch/Kibana infrastructure.