PT-2019-5279 · Elastic · Kibana

Published 2019-02-19 · Updated 2025-11-07 · CVE-2019-7609

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 5.6.15 and 6.6.1

Description The issue is related to insufficient code generation management in the Timelion visualizer of Kibana, which can lead to arbitrary code execution. An attacker with access to the Timelion application could send a request to execute javascript code, potentially resulting in the execution of arbitrary commands with the permissions of the Kibana process on the host system.

Recommendations For Kibana versions prior to 5.6.15, update to version 5.6.15 or later. For Kibana versions prior to 6.6.1, update to version 6.6.1 or later. As a temporary workaround, consider disabling the Timelion visualizer until a patch is available. Restrict access to the Timelion application to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2020-02180

CVE-2019-7609

RHSA-2019:2860

Affected Products

Kibana

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kibana_timelion_prototype_pollution_rce.rb · Exploit
• 🔥 https://github.com/LandGrey/CVE-2019-7609 · Exploit
• 🔥 https://github.com/jas502n/kibana-RCE · Exploit
• 🔥 https://github.com/mpgn/CVE-2019-7609 · Exploit
• 🔥 https://github.com/hekadan/CVE-2019-7609 · Exploit
• 🔥 https://github.com/Cr4ckC4t/cve-2019-7609 · Exploit
• 🔥 http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-7609 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02180 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-7609 · Security Note
• https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:2824 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2860 · Vendor Advisory
• https://t.me/rnetsec/10793 · Telegram Post