Attack Chain

1. An attacker gains control over content that is subsequently indexed into Elasticsearch by the vulnerable Django application.
2. The application's SearchIndex contains a SearchField declared with an index_fieldname (e.g., "name_s") that differs from its logical attribute name (e.g., "name").
3. The attacker-controlled data, specifically a crafted Python expression, is stored in Elasticsearch under the index_fieldname alias.
4. A search operation is performed, retrieving the malicious document from Elasticsearch, including the attacker-controlled _source data.
5. During result processing by ElasticsearchSearchBackend._process_results(), the backend attempts to map Elasticsearch fields to logical field names.
6. The lookup for the index_fieldname (e.g., "name_s") fails because index.fields is keyed by logical names (e.g., "name").
7. Due to the failed lookup, the raw, attacker-controlled value from Elasticsearch is passed to _to_python(value).
8. The _to_python() function then unconditionally calls eval(value), executing the attacker's injected Python expression with the privileges of the Django application.

Impact

This vulnerability results in Remote Code Execution (RCE), allowing an attacker to execute arbitrary Python and shell commands on the affected server. Successful exploitation grants the attacker the same privileges as the running Django application, leading to a complete compromise of the server's confidentiality, integrity, and availability. The impact extends to all Django applications that use the django-haystack Elasticsearch backend and declare SearchField instances with index_fieldname aliases, irrespective of their authentication configurations. The severity is high, as demonstrated by the CVSS 3.1 Base Score of 8.5.

Recommendation

• Patch the django-haystack library immediately to apply the provided fix that introduces index.field_map remapping and uses ast.literal_eval instead of eval().
• Deploy the provided Sigma rule to your SIEM to detect the creation of the RCE marker file /tmp/django_haystack_eval_rce_proof.
• Enable process creation logging on Linux servers to ensure visibility into executed commands, which is required for the provided Sigma rule.
• Review all SearchIndex configurations within your Django applications to identify and assess any SearchField declarations using index_fieldname aliases, especially those handling user-controlled input.