CVE-2019-7609

Elastic Kibana: Arbitrary Code Execution

As of , CVE-2019-7609 in Elastic Kibana is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 10 January 2022
US federal deadline
10 July 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.95Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
1 Metasploit module
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

CISA's description

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

The CVE record's description, from elastic

CVE published
25 March 2019
Assigned by
elastic
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-94
Improper Control of Generation of Code ('Code Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Kibana Timelion Prototype Pollution RCEexploit module, rank manual

Read further