Arbitrary Code Execution in Kibana Timelion

Repository contains a single Python exploit script for CVE-2019-7609 (Kibana Timelion RCE), plus README and MIT license. Main file: CVE-2019-7609-kibana-rce.py - Capability 1 (fingerprinting/versioning): Requests /app/kibana and extracts the Kibana version via regex patterns. If parsing fails, it defaults to '9.9.9' (effectively making verification fail). - Capability 2 (vuln verification): Sends a benign POST to /api/timelion/run with required headers (notably kbn-version) and checks for a 200 JSON response containing "seriesList". - Capability 3 (exploitation/RCE): When --shell is provided, it sends a crafted Timelion expression that abuses prototype pollution on label.__proto__.env to set environment variables (AAAA and NODE_OPTIONS). The injected code uses Node’s child_process.exec() to run a bash reverse shell back to the operator and creates a /tmp marker file to avoid repeated execution. It then performs a GET to a socket.io polling endpoint to trigger execution. Operator usage: - -u sets target base URL (default http://127.0.0.1:5601) - --shell enables exploitation after verification - -host/-port specify reverse shell callback destination. Overall purpose: network-based PoC/operational exploit to verify and then achieve remote code execution (reverse shell) against vulnerable Kibana instances via the Timelion API.

This repository provides a proof-of-concept exploit for CVE-2019-7609, a remote code execution vulnerability in Kibana's Timelion plugin (versions before 5.6.15 and 6.6.1). The exploit leverages prototype pollution via the Timelion 'props' function, ultimately allowing an attacker to inject arbitrary environment variables into the Node.js process. This is demonstrated in the provided JavaScript files (process.js, prototype-pollution.js) and the payload in poc.txt, which spawns a reverse shell to the attacker's host (host.docker.internal:1337). The repository includes: - Documentation and technical analysis in markdown files (readme.md, canvas.md, timelion.md, unflatten.md, spawn.md) explaining the vulnerability, exploitation process, and patch details. - A docker-compose.yml file to set up a vulnerable test environment with Elasticsearch and Kibana 6.5.4. - poc.txt containing the actual payload for exploitation. - JavaScript files demonstrating the prototype pollution and process spawning techniques. The exploit requires network access to the vulnerable Kibana instance and results in arbitrary command execution as the Kibana process. The main attack vector is network-based, targeting the Timelion API. The exploit is a proof-of-concept and not weaponized, but it demonstrates the full attack chain from prototype pollution to remote code execution.

This repository contains a single Metasploit module implementing a remote code execution (RCE) exploit for Kibana's Timelion application, targeting CVE-2019-7609. The exploit leverages a prototype pollution vulnerability in Kibana versions prior to 5.6.15 and between 6.0.0 and 6.6.1, allowing an attacker with access to the Timelion feature to execute arbitrary system commands as the Kibana process user. The module is written in Ruby and uses the Metasploit framework's HTTP client mixin to interact with the target Kibana instance. It performs version checks, retrieves necessary tokens, and sends a crafted payload to the '/api/timelion/run' endpoint, which results in code execution via Node.js. The default payload is a reverse bash shell, but this can be customized. The exploit is weaponized, providing reliable remote code execution and session management, and includes logic to clean up after exploitation to prevent repeated shell spawns. The only file in the repository is the Metasploit module itself, and all relevant logic is contained within it.

This repository contains a Python 3-compatible exploit for CVE-2019-7609, a remote code execution vulnerability in Elastic Kibana (versions <6.6.1 and 5.6.15). The main file, 'cve-modific.py', is a standalone exploit script that checks the Kibana version, verifies the presence of the vulnerability, and can deliver a reverse shell payload to a specified remote host and port. The exploit works by sending crafted requests to the '/api/timelion/run' endpoint and then triggering code execution via the '/socket.io/' endpoint. The payload uses bash to open a reverse shell back to the attacker's machine. The script is operational and requires the attacker to specify the target Kibana URL, the attacker's host, and port for the reverse shell. The repository is structured simply, with a README describing the changes and usage, and the main exploit script. No framework is used; this is a standalone operational exploit.

This repository contains a Python 3 exploit for CVE-2019-7609, a remote code execution vulnerability in Kibana's Timelion visualizer affecting versions before 5.6.15 and between 6.0.0 and before 6.6.1. The exploit consists of a single script, 'cve-2019-7609.py', which performs the following steps: (1) retrieves the Kibana version from the target, (2) verifies if the target is vulnerable, (3) uploads a payload via the '/api/timelion/run' endpoint, and (4) triggers the payload via the '/socket.io/' endpoint. The payload is a bash reverse shell that connects back to an attacker-controlled listener. The script requires three arguments: the target Kibana URL, the attacker's listener IP, and the listener port. The README provides usage instructions and context. No framework is used; the exploit is standalone and operational, providing a working reverse shell if successful.

This repository contains a Python 2 exploit script (CVE-2019-7609-kibana-rce.py) targeting CVE-2019-7609, a remote code execution vulnerability in Elastic Kibana versions prior to 6.6.1 (and 5.6.15). The script first checks the Kibana version by querying the /app/kibana endpoint, then verifies the vulnerability by sending a crafted request to /api/timelion/run. If the target is vulnerable, the script can optionally launch a reverse shell payload, connecting back to an attacker-specified host and port using a bash one-liner. The exploit leverages prototype pollution and environment variable injection to achieve code execution. The repository also includes a README with usage instructions and a LICENSE file. The main entry point is the Python script, which is operational and provides a working exploit with a customizable reverse shell payload.

This repository provides a proof-of-concept exploit for CVE-2019-7609, a remote code execution vulnerability in Kibana's Timelion visualizer. The repository contains a README.md with detailed exploitation steps and a docker-compose.yml to set up a vulnerable environment (Kibana 6.5.4 and Elasticsearch 6.6.0). The exploit involves injecting a specially crafted payload into the Timelion interface, which results in the Kibana server executing a reverse shell to the attacker's machine. The README also includes patch information and a reference to the upstream fix. No actual exploit code is present; the exploit is performed manually via the Kibana web interface. The main endpoints involved are the local Kibana web interface (http://127.0.0.1:5601) and the attacker's TCP listener for the reverse shell.

This repository documents a proof-of-concept exploit for CVE-2019-7609, an arbitrary code execution vulnerability in Kibana's Timelion visualizer affecting versions before 5.6.15 and 6.6.1. The exploit is performed by injecting a specially crafted JavaScript payload into the Timelion visualizer, which abuses prototype pollution to set environment variables and execute arbitrary system commands via Node.js. The provided payloads spawn a reverse shell to an attacker-controlled host. The repository contains two markdown files: 'Readme.md', which explains the vulnerability, provides payloads, and references advisories and patches; and 'lab.md', which gives step-by-step instructions for setting up a vulnerable Kibana environment using Docker and testing the exploit. No executable code is present; the exploit is performed manually via the Kibana web interface. The main attack vector is network-based, requiring access to the Kibana web UI. Several endpoints are referenced, including example IP addresses and ports for reverse shells and the Kibana web interface.