A newly detailed offensive security tool called RAVEN shows how a compromised Elasticsearch environment can become a data-loss incident with persistent access.
The tool demonstrates what an intruder could do after reaching an exposed cluster or controlling Kibana. The attack path begins after reconnaissance and exploitation have opened the door.
An operator can query Elasticsearch, copy stored records, create alternate credentials, and leave mechanisms that restore access after a defender begins cleanup.
LevelBlue said in a report shared with Cyber Security News (CSN) that its researchers frame RAVEN as a controlled penetration-testing utility, not evidence of a live criminal campaign, but its workflow illustrates the consequences of weakly protected data platforms.
The research used Docker-based Elasticsearch 7.17.22 labs, with and without X-Pack security.
It followed earlier testing that reached Elasticsearch through port 9200 and gained code execution through port 5601 after Kibana compromise, a route made more worrying by critical Kibana code execution flaws reported elsewhere.
RAVEN Tool Exfiltrates Entire Elasticsearch Databases and Maintains Access
RAVEN’s exfiltration module can pull a chosen index or export every non-system index to local newline-delimited JSON files.
For newer Elasticsearch releases, it uses the Point-in-Time API to step through records; it can use the Scroll API on versions before 7.10.
A single foothold can therefore become a practical way to collect customer, order, or application datasets.
The tool can resume interrupted collection; its batch setting lets an operator trade speed for less conspicuous requests.
It can also send copied data into an attacker-controlled Elasticsearch server, retaining index mappings and settings. This is a concrete business risk, not proof that records were readable.
.webp)
RAVEN also offers a server-side snapshot method. An operator can register a repository on the target and create a snapshot of selected indexes.
Since bulk movement occurs inside Elasticsearch rather than network traffic, this approach may create far less visible activity than repeated queries. The report says unusual snapshot repositories and jobs deserve investigation.
Exposure of Elasticsearch and its management layer remains dangerous when vulnerabilities or insecure settings provide the initial foothold.
Organizations should prioritize fixes, including issues covered in recent Elastic security patches, and restrict access to management ports rather than leaving them open to untrusted networks.
API Keys Outlive Password Changes
The more persistent part of the demonstration involves Elasticsearch API keys. RAVEN can list keys visible to the compromised user and create a new key carrying that user’s permissions.
The credential can authenticate without the user’s password, so password rotation does not automatically end access.
The report also describes attempts to harvest keys from the security index where permissions allow it.
Stolen service credentials could give an intruder another path into automated jobs, monitoring, or internal services. Revoking a legitimate key can also interrupt them, turning credential management into a targeted availability problem.
RAVEN’s persistence module adds three layers: a rogue high-privilege user, a long-lived API key, and an Elasticsearch Watcher task.
The Watcher runs on a schedule and checks whether the user and key remain present. If defenders delete either but miss the Watcher, it can recreate them and defeat a partial cleanup.
.webp)
That changes the response plan. Teams should inventory users, API keys, service accounts, Watcher definitions, repositories, and recent security changes before declaring containment.
They should invalidate unknown keys explicitly, remove unauthorized Watchers first, rotate affected credentials, and review audit logs for suspicious identities.
Guidance on API key authentication bypasses likewise shows why issued keys need their own review and revocation process. RAVEN records state-changing actions in an activity log, with reversal information.
While that supports authorised test cleanup, defenders cannot assume an attacker will leave such a record.
Password rotation is only one containment step; recovery also requires finding every independent credential and scheduled mechanism that can reopen the door.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
