CVE-2019-7609
published 2019-03-25CVE-2019-7609: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion…
PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-07-10
Exploited in the wild
EPSS
95.34%
99.9th percentile
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | < 5.6.15 | 5.6.15 |
| elastic | kibana | — | — |
| elastic | kibana | >= 6.0.0 < 6.6.1 | 6.6.1 |
| intlify | shared | >= 10.0.0 < 10.0.5 | 10.0.5 |
| intlify | shared | >= 9.7.0 < 9.14.2 | 9.14.2 |
| intlify | vue-i18n | >= 10.0.0 < 10.0.5 | 10.0.5 |
| intlify | vue-i18n | >= 9.7.0 < 9.14.2 | 9.14.2 |
| intlify | vue-i18n-core | >= 10.0.0 < 10.0.5 | 10.0.5 |
| intlify | vue-i18n-core | >= 9.7.0 < 9.14.2 | 9.14.2 |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
other{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}↗
- →Detect exploitation attempts by monitoring POST requests to /api/timelion/run containing prototype pollution payloads referencing __proto__ or NODE_OPTIONS in the request body. ↗
- →Look for the string 'seriesList' in HTTP response bodies from /api/timelion/run as a confirmation indicator that the Timelion endpoint is active and responding. ↗
- →Monitor for NODE_OPTIONS environment variable manipulation (e.g., '--require /proc/self/environ') in process environments spawned by the Kibana process, which is the core gadget used in exploitation. ↗
- →Alert on outbound /dev/tcp connections or reverse shell activity originating from the Kibana process, as the PoC exploit establishes a reverse shell via bash /dev/tcp. ↗
- →Use Shodan/FOFA/Google dorks to identify exposed Kibana instances: shodan-query 'http.title:"kibana"', fofa-query 'title="kibana"', google-query 'intitle:"kibana"'. ↗
- →The Metasploit module targets Kibana versions 3.0–5.6.14 and 6.0.0–6.6.0; detection should flag these version strings in HTTP response headers or banner grabs. ↗
- ·If upgrading Kibana is not immediately feasible, disable the Timelion visualizer by setting 'timelion.enabled' to false in kibana.yml to eliminate the attack surface. ↗
- ·The Metasploit WFSDELAY parameter is critical: too high causes many shells (50–100+), too low causes no shells; tuning is required per target environment. ↗
- ·Exploitation requires a service or system reboot to restore normal Kibana operation after the prototype pollution attack. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
@intlify/shared Prototype Pollution vulnerability
osv·2024-12-02
CVE-2024-52810 [MEDIUM] @intlify/shared Prototype Pollution vulnerability
@intlify/shared Prototype Pollution vulnerability
**Vulnerability type: Prototype Pollution**
**Affected Package:**
Product: @intlify/shared
Version: 10.0.4
**Vulnerability Location(s):**
`node_modules/@intlify/shared/dist/shared.cjs:232:26`
**Description:**
The latest version of `@intlify/shared (10.0.4)` is vulnerable to Prototype Pollution through the entry function(s) `lib.deepCopy`. An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.
Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates
GHSA
@intlify/shared Prototype Pollution vulnerability
ghsa·2024-12-02
CVE-2024-52810 [MEDIUM] CWE-1321 @intlify/shared Prototype Pollution vulnerability
@intlify/shared Prototype Pollution vulnerability
**Vulnerability type: Prototype Pollution**
**Affected Package:**
Product: @intlify/shared
Version: 10.0.4
**Vulnerability Location(s):**
`node_modules/@intlify/shared/dist/shared.cjs:232:26`
**Description:**
The latest version of `@intlify/shared (10.0.4)` is vulnerable to Prototype Pollution through the entry function(s) `lib.deepCopy`. An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.
Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates
GHSA
GHSA-cp8f-5jp9-rqmh: Kibana versions before 5
ghsa_unreviewed·2022-05-13
CVE-2019-7609 [CRITICAL] CWE-94 GHSA-cp8f-5jp9-rqmh: Kibana versions before 5
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
VulnCheck
Kibana Arbitrary Code Execution
vulncheck·2019·CVSS 10.0
CVE-2019-7609 [CRITICAL] CWE-94 Kibana Arbitrary Code Execution
Kibana Arbitrary Code Execution
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Affected: Elastic Kibana
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://cisa.gov/news-events/alerts/2022/01/11/understanding-and-mitigating-russian-state-sponsored-cyber-threats-us; https://cisa.gov/news-events/cybersecurity-advisories/aa22-011a; https://www.cisa.gov/uscert/ncas/alerts/aa22-011a; https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf; https://www.cisa.gov/sites/
CISA
Kibana Arbitrary Code Execution
cisa·2022-01-10·CVSS 10.0
CVE-2019-7609 [CRITICAL] CWE-94 Kibana Arbitrary Code Execution
Vulnerability: Kibana Arbitrary Code Execution
Affected: Elastic Kibana
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7609
Remediation Due Date: 2022-07-10
Red Hat
kibana: Arbitrary code execution flaw in the Timelion visualizer
vendor_redhat·2019-02-19·CVSS 10.0
CVE-2019-7609 [CRITICAL] CWE-20 kibana: Arbitrary code execution flaw in the Timelion visualizer
kibana: Arbitrary code execution flaw in the Timelion visualizer
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
An arbitrary code execution flaw was found in the Timelion visualizer in Kibana versions before 5.6.15 and 6.6.1. This flaw allows an attacker with access to the Timelion application to send a request that attempts to execute javascript code. This could lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Package: kiban
Suricata
ET WEB_SPECIFIC_APPS Kibana Prototype Pollution RCE Inbound (CVE-2019-7609)
suricata·2021-07-27·CVSS 10.0
CVE-2019-7609 [CRITICAL] ET WEB_SPECIFIC_APPS Kibana Prototype Pollution RCE Inbound (CVE-2019-7609)
ET WEB_SPECIFIC_APPS Kibana Prototype Pollution RCE Inbound (CVE-2019-7609)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Kibana Prototype Pollution RCE Inbound (CVE-2019-7609)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/timelion/run"; fast_pattern; http.request_body; content:"|7b 22|sheet|22|"; startswith; content:".__proto__."; content:"child_process"; distance:0; content:".exec|28|"; distance:0; reference:url,github.com/mpgn/CVE-2019-7609; reference:cve,2019-7609; classtype:attempted-admin; sid:2033452; rev:2; metadata:created_at 2021_07_27, cve CVE_2019_7609, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)
Metasploit
Kibana Timelion Prototype Pollution RCE
metasploit
Kibana Timelion Prototype Pollution RCE
Kibana Timelion Prototype Pollution RCE
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This leads to an arbitrary command execution with permissions of the Kibana process on the host system. Exploitation will require a service or system reboot to restore normal operation. The WFSDELAY parameter is crucial for this exploit. Setting it too high will cause MANY shells (50-100+), while setting it too low will cause no shells to be obtained. WFSDELAY of 10 for a docker image caused 6 shells. Tested against kibana 6.5.4.
Nuclei
Kibana Timelion - Arbitrary Code Execution
nuclei·CVSS 10.0
CVE-2019-7609 [CRITICAL] Kibana Timelion - Arbitrary Code Execution
Kibana Timelion - Arbitrary Code Execution
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Template:
id: CVE-2019-7609
info:
name: Kibana Timelion - Arbitrary Code Execution
author: dwisiswant0
severity: critical
description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an att
Qualys
Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines
blogs_qualys·2022-02-26
Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines
## Table of Contents
Protecting Customer Data on Qualys Cloud Platform
Urgent: Assess and Heighten Your Security Posture
Step 1: Monitor Your Shodan/Internet Exposed Assets
Step 2: Detect, Prioritize and Remediate CISAs Catalog ofKnown Exploited Vulnerabilities
Step 3: Protect Your Cloud Services and Office 365
Step 4: Continuously Detect any Potential Threats and Attacks
Take Action to Learn More about How to Strengthen Your Defenses
CISA has created Shields Up as a response to the Russian invasion of Ukraine. Qualys is responding with additional security, monitoring and governance measures. This blog details how and what our enterprise customers can do to immediately strengthen their security posture and meet CISA’s recommendations.
With the invasion of Ukraine by Russia, the U.
Tenable
Government Advisories Warn of APT Activity Resulting from Russian Invasion of Ukraine
blogs_tenable·2022-02-24
Government Advisories Warn of APT Activity Resulting from Russian Invasion of Ukraine
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
blogs_unit42·2022-02-22
Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
Threat Research Center
Threat Research
Malware
## Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
Unit 42
Published: February 22, 2022
Malware
Threat Research
DDoS
Defacement
Gamaredon
HermeticWiper
Nation-state
Russia
Trident Ursa
Ukraine
WhisperGate
## Executive Summary
Over the past several weeks, Russia-Ukraine cyber activity has escalated substantially. Beginning on Feb. 15, a series of distributed denial of service (DDoS) attacks commenced. These attacks have continued over the past week, impacting both the Ukrainian government and banking institutions. On Feb. 23, a new variant of wiper malware named HermeticWiper was discovered in Ukraine. Shortl
Unit42
Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
blogs_unit42·2022-02-22
Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
## Executive Summary
Over the past several weeks, Russia-Ukraine cyber activity has escalated substantially. Beginning on Feb. 15, a series of distributed denial of service (DDoS) attacks commenced. These attacks have continued over the past week, impacting both the Ukrainian government and banking institutions. On Feb. 23, a new variant of wiper malware named HermeticWiper was discovered in Ukraine. Shortly after, a new round of website defacement attacks were also observed impacting Ukrainian government organizations.
Consistent with our previous reporting on the topic, several western governments have issued recommendations for their populations to prepare for cyberattacks that could disrupt, disable or destroy critical infrastructure. We have already observed an increase in Russian c
Tenable
Identifying Prototype Pollution Vulnerabilities: How Tenable.io Web Application Scanning Can Help
blogs_tenable·2021-05-25
Identifying Prototype Pollution Vulnerabilities: How Tenable.io Web Application Scanning Can Help
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
CVE-2019-7609: Exploit Script Available for Kibana Remote Code Execution Vulnerability
blogs_tenable·2019-10-22·CVSS 10.0
[CRITICAL] CVE-2019-7609: Exploit Script Available for Kibana Remote Code Execution Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
arXiv
GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes
arxiv_fulltext·2024-07-15
GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes
: Universal Prototype Pollution Gadgets in JavaScript Runtimes
Eric Cornelissen
KTH Royal Institute of Technology
Mikhail Shcherbakov
KTH Royal Institute of Technology
Musard Balliu
KTH Royal Institute of Technology
## Abstract
Prototype pollution is a recent vulnerability that affects JavaScript code, leading to high impact attacks such as arbitrary code execution and privilege escalation. The vulnerability is rooted in JavaScript's prototype-based inheritance, enabling attackers to inject arbitrary properties into an object's prototype at runtime. The impact of prototype pollution depends on the existence of otherwise benign pieces of code (gadgets), which inadvertently read from these attacker-controlled properties to execute security-sensitive operations. While prior works prim
CTF
README
ctf_writeups
README
# CTF Writeups
Welcome to my CTF Writeups repository! Here, I document the solutions and methodologies used to solve various Capture The Flag (CTF) challenges. This repository is intended to serve as a learning resource for others interested in cybersecurity and CTF competitions.
Capture The Flag (CTF) competitions are a popular way to practice and improve cybersecurity skills. These competitions present various challenges that require problem-solving, creativity, and technical knowledge.
## Writeups
The writeups in this repository (located in the "writeups" folder) are categorised based on the nature of the challenge. Each writeup provides step-by-step solutions, along with explanations of the tools and techniques used. The difficulty rating associated with each challenge matches the dif
Bugzilla
CVE-2019-7609 kibana: Arbitrary code execution flaw in the Timelion visualizer
bugzilla·2019-04-04·CVSS 10.0
CVE-2019-7609 [CRITICAL] CVE-2019-7609 kibana: Arbitrary code execution flaw in the Timelion visualizer
CVE-2019-7609 kibana: Arbitrary code execution flaw in the Timelion visualizer
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
References:
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
Discussion:
No versions of Red Hat OpenStack Platform Operational Tools are affected by this flaw.
---
OpenShift Container Platform 3.11 and 4.1 contain 5.6.13:
$ docker run -ti registry.redhat.io/openshift3/ose-logging-kibana5:v3.11 rpm -q kibana
kibana-5.6.13-
http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.elastic.co/community/securityhttp://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.elastic.co/community/securityhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609
2019-03-25
Published
2022-01-10
Added to CISA KEV
Exploited in the wild