RAVEN tool

This article demonstrates RAVEN, an Elasticsearch and Kibana exploitation framework, against deliberately vulnerable lab environments. RAVEN tracks 8 Elastic-specific CVEs and provides working exploits for 6 of them, including root-level RCE via MVEL script injection (CVE-2014-3120), Groovy sandbox bypass via Java reflection (CVE-2015-1427), and arbitrary file read via Snapshot API directory traversal (CVE-2015-5531). The framework also includes version-based detection without exploitation for CVE-2020-7009/7014 (API key privilege escalation) and a scripting module that abuses legitimate Elasticsearch scripting functionality when valid credentials are available.