CVE-2018-17246
published 2018-12-20CVE-2018-17246: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could…
PriorityP190critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
82.25%
99.6th percentile
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | >= 5.0.0 < 5.6.13 | 5.6.13 |
| elastic | kibana | >= 6.0.0 < 6.4.3 | 6.4.3 |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd↗
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/console/api_server?apis=|2e 2e 2f 2e 2e 2f|"; fast_pattern; reference:url,github.com/mpgn/CVE-2018-17246; reference:cve,2018-17246; classtype:attempted-admin; sid:2033453; rev:3; metadata:created_at 2021_07_27, cve CVE_2018_17246, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/console/api_server?sense_version="; startswith; fast_pattern; content:"SENSE_VERSION&apis="; pcre:"/^(?:\.\.\/){2,}/R"; reference:url,www.bleepingcomputer.com/news/security/file-inclusion-bug-in-kibana-console-for-elasticsearch-gets-exploit-code/; classtype:attempted-user; sid:2026739; rev:5; metadata:attack_target Web_Server, created_at 2018_12_19, cve CVE_2018_17246, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2024_04_13;)bytes
|2e 2e 2f 2e 2e 2f|
- →Look for GET requests to /api/console/api_server with the 'apis' parameter containing path traversal sequences (../../) to detect LFI exploitation attempts.
- →Response body containing the string '"message":"An internal server error occurred"' combined with a response header containing 'kbn-name' or 'kibana' (case-insensitive) indicates a vulnerable Kibana instance was probed.
- →Use Shodan, FOFA, or Google dorks to identify exposed Kibana instances that may be vulnerable.
- →The vulnerability was introduced in the console api_server plugin starting from Kibana version 5; prior versions do not contain the vulnerable functionality.
- ·Red Hat OpenShift Container Platform versions 3.2 through 3.10, 3.2–3.9, and OCP 4 ship Kibana builds that are NOT affected by this CVE, as they do not include the vulnerable Console plugin. ↗
- ·OpenShift Enterprise 3.x prior to 3.11 ships Kibana versions that do not contain the console plugin or the commit which introduced the vulnerable code and are therefore not affected. ↗
- ·OpenShift Enterprise 3.11 ships kibana-5.6.10, which IS affected and requires patching. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cpwf-64qm-2jpm: Kibana versions before 6
ghsa_unreviewed·2022-05-13
CVE-2018-17246 [CRITICAL] CWE-829 GHSA-cpwf-64qm-2jpm: Kibana versions before 6
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
VulnCheck
Elastic Kibana External Control of File Name or Path
vulncheck·2018·CVSS 9.8
CVE-2018-17246 [CRITICAL] Elastic Kibana External Control of File Name or Path
Elastic Kibana External Control of File Name or Path
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Affected: Elastic Kibana
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2018-17246; https://dashboard.shadowserver.org/statistics/honeypot/
Red Hat
kibana: Arbitrary file inclusion vulnerability in the Console plugin
vendor_redhat·2018-11-06·CVSS 9.8
CVE-2018-17246 [CRITICAL] CWE-20 kibana: Arbitrary file inclusion vulnerability in the Console plugin
kibana: Arbitrary file inclusion vulnerability in the Console plugin
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Kibana, before 6.4.3 and 5.6.13, contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Package: kibana (Red Hat OpenShift Co
Suricata
ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)
suricata·2021-07-27·CVSS 9.8
CVE-2018-17246 [CRITICAL] ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)
ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/console/api_server?apis=|2e 2e 2f 2e 2e 2f|"; fast_pattern; reference:url,github.com/mpgn/CVE-2018-17246; reference:cve,2018-17246; classtype:attempted-admin; sid:2033453; rev:3; metadata:created_at 2021_07_27, cve CVE_2018_17246, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery;
Suricata
ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)
suricata·2018-12-19·CVSS 9.8
CVE-2018-17246 [CRITICAL] ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)
ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/console/api_server?sense_version="; startswith; fast_pattern; content:"SENSE_VERSION&apis="; pcre:"/^(?:\.\.\/){2,}/R"; reference:url,www.bleepingcomputer.com/news/security/file-inclusion-bug-in-kibana-console-for-elasticsearch-gets-exploit-code/; classtype:attempted-user; sid:2026739; rev:5; metadata:attack_target Web_Server, created_at 2018_12_19, cve CVE_2018_17246, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2024_04_13;)
Nuclei
Kibana - Local File Inclusion
nuclei·CVSS 9.8
CVE-2018-17246 [CRITICAL] Kibana - Local File Inclusion
Kibana - Local File Inclusion
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Template:
id: CVE-2018-17246
info:
name: Kibana - Local File Inclusion
author: princechaddha,thelicato
severity: critical
description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands wi
CTF
medium / README
ctf_writeups·CVSS 9.1
[CRITICAL] medium / README
---
layout: default
title: Medium Machines
parent: Machines
nav_order: 2
description: "112+ Medium HTB machine writeups with walkthroughs"
permalink: /machines/medium/
---
# HackTheBox - Medium Machines
> Comprehensive index of retired HTB Medium-difficulty machines with key techniques and attack path summaries.
**Total: 100+ machines** | Sorted roughly by retirement date (newest first)
---
## Machine Index
| # | Machine | OS | Key Techniques | Attack Path Summary | Writeup |
|---|---------|-----|----------------|---------------------|---------|
| 1 | Signed | Linux | Code Signing Bypass, Certificate Abuse | Forge code signature to deploy malicious update, escalate via trusted binary execution | [0xdf](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) |
| 2 | Voleur | Linux | Data E
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
CTF
AdventOfCyber / README
ctf_writeups
AdventOfCyber / README
# Day1 Inventory Management
```
Elves needed a way to submit their inventory - have a web page where they submit their requests and the elf mcinventory can look at what others have submitted to approve their requests. It’s a busy time for mcinventory as elves are starting to put in their orders. mcinventory rushes into McElferson’s office.
I don’t know what to do. We need to get inventory going. Elves can log on but I can’t actually authorise people’s requests! How will the rest start manufacturing what they want.
McElferson calls you to take a look at the website to see if there’s anything you can do to help. Deploy the machine and access the website at http://:3000 - it can take up to 3 minutes for your machine to boot!
```
## 1. What is the name of the cookie used for authentication?
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2018-17246 kibana: Arbitrary file inclusion vulnerability in the Console plugin
bugzilla·2018-11-07·CVSS 9.8
CVE-2018-17246 [CRITICAL] CVE-2018-17246 kibana: Arbitrary file inclusion vulnerability in the Console plugin
CVE-2018-17246 kibana: Arbitrary file inclusion vulnerability in the Console plugin
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
References:
https://www.elastic.co/community/security
Introduced in commit:
https://github.com/elastic/kibana/commit/0d3461c2c995e7ce5bb3e04ba5cecbc05a5386ab#diff-263cb6070b4e54ae3b4c343d14d0813bR25
Upstream issue:
https://github.com/elastic/kibana/pull/24399
Upstream patch:
https://github.com/elastic/kibana/commit/51aff7d3c49724fcbaba4353dff0cd7c3be799b0
http://www.securityfocus.com/bid/106285https://access.redhat.com/errata/RHBA-2018:3743https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594https://www.elastic.co/community/securityhttp://www.securityfocus.com/bid/106285https://access.redhat.com/errata/RHBA-2018:3743https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594https://www.elastic.co/community/security
2018-12-20
Published
Exploited in the wild