A new demonstration involving the RAVEN Elasticsearch security-testing tool shows how a compromised cluster can lead to full data theft and long-term unauthorized access.
The research highlights why exposed or poorly secured Elasticsearch deployments remain a serious enterprise risk.
RAVEN can extract documents from individual Elasticsearch indices or export data from every non-system index.
The stolen records are saved in NDJSON format, allowing attackers to search, parse, or import the data into another Elasticsearch environment.
This turns an initial access issue into a direct business-impact event, an intruder could copy customer records, internal logs, orders, and other indexed information.
The tool uses Elasticsearch pagination features to collect records in batches. It can also resume interrupted extraction jobs, reducing the impact of network failures during large data transfers.
For defenders, this means unusual query volume, repeated pagination activity, or unexpected exports should be investigated promptly.
RAVEN also demonstrates snapshot-based theft. Instead of transferring large volumes of data through repeated queries, an attacker could register a repository and create a server-side snapshot.
The snapshot may place a copy of selected indices on the target server’s filesystem, potentially making detection through network monitoring more difficult.
RAVEN Rebuilds Elasticsearch Backdoors
The research also focuses on Elasticsearch API keys. Unlike a normal username and password, an API key can remain valid after a password rotation unless administrators explicitly invalidate it.
An attacker with sufficient access could create an API key that inherits the permissions of the account used to generate it. If defenders only reset passwords after an intrusion, that key may continue to provide access to data and cluster operations.
RAVEN can also enumerate visible API keys, helping testers identify service credentials and automation accounts. In a real attack, exposed or overly privileged keys could become a path to deeper access.
Defenders should maintain an inventory of API keys, assign only required privileges, set expirations where possible, and revoke keys during incident response.
The most concerning capability is persistence. RAVEN demonstrates three methods: creation of a rogue privileged user, generation of a long-lived API key, and use of Elasticsearch Watcher to monitor and restore deleted access mechanisms.
Watcher is normally used for alerting and scheduled actions. In this scenario, it is abused to check whether a hidden user account or API key still exists.
If defenders delete the account or revoke the key but miss the Watcher task, the tool can recreate the removed backdoor during its next scheduled run.
This creates a remediation trap. Password resets alone do not remove a separately created user. Deleting a user does not help if an automated task recreates it.
Revoking an API key is also temporary if the persistence mechanism remains active, levelblue said.
Security teams responding to Elasticsearch incidents should review user accounts, roles, API keys, Watcher configurations, snapshot repositories, and recent audit logs.
They should also validate that no unexpected scheduled tasks can restore deleted credentials.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
