{"record":{"id":"703c28fb7dcff9c4","repo":"shadow1ng/fscan","slug":"s-703c28","errorCode":null,"errorMessage":"%s","messagePattern":"%s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/elasticsearch.go","lineNumber":52,"sourceCode":"\n\t// 首先检测未授权访问\n\tif p.testCredential(ctx, info, Credential{Username: \"\", Password: \"\"}, session) {\n\t\tsession.LogVuln(i18n.Tr(\"elasticsearch_unauth\", target))\n\t\treturn &ScanResult{\n\t\t\tSuccess: true,\n\t\t\tType:    plugins.ResultTypeVuln,\n\t\t\tService: \"elasticsearch\",\n\t\t\tVulInfo: i18n.GetText(\"unauthorized_access\"),\n\t\t}\n\t}\n\n\t// 如果需要认证，尝试常见凭据\n\tcredentials := GenerateCredentials(\"elasticsearch\", config)\n\tif len(credentials) == 0 {\n\t\treturn &ScanResult{\n\t\t\tSuccess: false,\n\t\t\tService: \"elasticsearch\",\n\t\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"service_no_credentials\")),\n\t\t}\n\t}\n\n\tfor _, cred := range credentials {\n\t\tif p.testCredential(ctx, info, cred, session) {\n\t\t\tsession.LogVuln(i18n.Tr(\"elasticsearch_credential\", target, cred.Username, cred.Password))\n\t\t\treturn &ScanResult{\n\t\t\t\tSuccess:  true,\n\t\t\t\tType:     plugins.ResultTypeCredential,\n\t\t\t\tService:  \"elasticsearch\",\n\t\t\t\tUsername: cred.Username,\n\t\t\t\tPassword: cred.Password,\n\t\t\t}\n\t\t}\n\t}\n\n\treturn &ScanResult{\n\t\tSuccess: false,","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/elasticsearch.go#L34-L70","documentation":"The Elasticsearch plugin's Scan builds candidate credentials via GenerateCredentials(\"elasticsearch\", config); when the list is empty it aborts with this error from i18n key service_no_credentials. The plugin refuses to proceed because there is nothing to authenticate with, and a ScanResult with Success:false is returned instead of attempting the HTTP checks.","triggerScenarios":"Scan called with a config that supplies no custom elasticsearch credentials and yields no generated defaults — e.g. empty username/password lists, missing dictionary, or config fields cleared by the caller.","commonSituations":"Running the scan with an empty or minimal config file; a refactor that renamed the config keys the credential generator reads; disabling the default-credential generation feature; service name mismatch so nothing is generated.","solutions":["Add elasticsearch credentials to the scan config (custom user/pass pairs) or re-enable default credential generation.","Verify the dictionary/wordlist files referenced by the config exist and are readable and non-empty.","Log GenerateCredentials(\"elasticsearch\", config) output to confirm which config keys feed it and which are missing.","If no credential testing is desired, skip the plugin instead of calling Scan."],"exampleFix":"// before\nconfig := &Config{} // no credentials configured\nres := esPlugin.Scan(ctx, info, session)\n// after\nconfig := &Config{Credentials: []Credential{{Username: \"elastic\", Password: \"changeme\"}}}\nres := esPlugin.Scan(ctx, info, session)","handlingStrategy":"validation","validationCode":"creds := GenerateCredentials(\"elasticsearch\", config)\nif len(creds) == 0 {\n    return errors.New(\"elasticsearch scan aborted: provide credentials or fix dictionary config\")\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, info, session)\nif !res.Success && res.Error != nil && res.Error.Error() == i18n.GetText(\"service_no_credentials\") {\n    log.Printf(\"no credentials for %s; configure them and rerun\", res.Service)\n    return nil\n}","preventionTips":["Populate credential config before running service plugins","Verify wordlist files exist and are non-empty at startup","Do not clear credential fields when copying config structs","Dry-run GenerateCredentials during config validation"],"tags":["go","elasticsearch","credentials","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}