CVE-2019-7609criticalunder attackCWE-94

CVE-2019-7609: critical vulnerability in Elastic Kibana

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 95%
from disclosure to weapon207 days
Published on NVDMar 25
1st PoC+207d
metasploit+219d
CISA KEV+1022d
exploitation probability
95%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
26 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
2 products (156 components)
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4.1
fix ↗
Not affected
8 products (12 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.6 · Red Hat OpenShift Container Platform 3.7 · Red Hat OpenShift Container Platform 3.9 · Red Hat OpenShift Container Platform 3.4 · and others 3
Action required by CISAfederal deadline: 2022-07-10

Apply updates per vendor instructions.

In short

Kibana's Timelion visualizer allows attackers with application access to execute arbitrary JavaScript code, which can lead to running commands on the server with Kibana's permissions.

Technical detail

CVE-2019-7609 is an arbitrary code execution vulnerability in Timelion visualizer (CWE-94: Improper Control of Generation of Code) affecting Kibana versions before 5.6.15 and 6.6.1. An authenticated attacker can craft a malicious request to inject and execute JavaScript, potentially achieving remote code execution with the privileges of the Kibana process on the host system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Elastic · Kibana
public PoCs found — 26
githubgithub.com/LandGrey/CVE-2019-7609★ 167githubgithub.com/jas502n/kibana-RCE★ 89githubgithub.com/mpgn/CVE-2019-7609★ 56githubgithub.com/hekadan/CVE-2019-7609★ 21githubgithub.com/Cr4ckC4t/cve-2019-7609★ 4githubgithub.com/rhbb/CVE-2019-7609★ 1githubgithub.com/dnr6419/CVE-2019-7609★ 1githubgithub.com/Akshay15-png/CVE-2019-7609★ 1githubgithub.com/wolf1892/CVE-2019-7609★ 0githubgithub.com/aleister1102/kibana-prototype-pollusion★ 0githubgithub.com/toxxxaka/CVE-2019-7609★ 0githubgithub.com/d0x-awrqxavc/CVE-2019-7609-KibanaRCE★ 0vulncheckvulncheck.com/xdb/e88fe8b26b66unverifiedcve_referencepacketstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/a7f51bb4593funverifiedvulncheckvulncheck.com/xdb/1293a1a85b89unverifiedvulncheckvulncheck.com/xdb/baa23d069da5unverifiedvulncheckvulncheck.com/xdb/72f85a29c165unverifiedvulncheckvulncheck.com/xdb/31a2493d581cunverifiedvulncheckvulncheck.com/xdb/b2f2b26f8c21unverifiedvulncheckvulncheck.com/xdb/b89478e4dff2unverifiedvulncheckvulncheck.com/xdb/99729775468dunverifiedvulncheckvulncheck.com/xdb/c711254ccffcunverifiedvulncheckvulncheck.com/xdb/1c48e403c9e9unverifiedvulncheckvulncheck.com/xdb/47c366ae2f29unverifiedvulncheckvulncheck.com/xdb/6ec76e8d16e1unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Elastic Kibana

In the same product, most dangerous first.

CVE-2018-17246—CVE-2018-17246EPSS 82.3%CVE-2025-25014CRITICALKibana arbitrary code execution via prototype pollutionEPSS 22.2%CVE-2020-7012—CVE-2020-7012EPSS 18.2%CVE-2019-7610—CVE-2019-7610EPSS 3.9%CVE-2019-7616—CVE-2019-7616EPSS 2.4%CVE-2020-7013—CVE-2020-7013EPSS 2.1%
References
http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609https://www.elastic.co/community/security