elasticsearch/elasticsearch — pull request #6164 by Fitblip (2014-05-14 07:51:15+00:00)
Title: Make JSONP responses optional.

This poses a significant security threat by being on by default. If an attacker can entice a user to load a legitimate ElasticSearch query as a script tag, they can effectively bypass SOP and exfiltrate the contents of a local ElasticSearch instance (or bypass firewall rules by using a victim's browser to talk to a remote instance).

This would be trivial to implement from an attackers perspective, and I'll be submitting a pull request to the BeEF project (https://github.com/beefproject/beef) to automate this sort of attack, as it'll be useful during a pentesting engagement.

If you have any questions or change requests please let me know, and I'll be more than happy to accommodate.

Thanks!
Fitblip