nuclei-templates/cves/2019/CVE-2019-7609.yaml

id: CVE-2019-7609

info:
  name: Kibana Timelion Arbitrary Code Execution
  author: dwisiswant0
  severity: critical
  description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference:
    - https://github.com/mpgn/CVE-2019-7609
    - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
  tags: cve,cve2019,kibana,rce

requests:
  - method: POST
    path:
      - "{{BaseURL}}/api/timelion/run"
    headers:
      Content-Type: "application/json; charset=utf-8"

    body: '{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "seriesList"
        part: body

      - type: word
        words:
          - "application/json"
        part: header

      - type: status
        status:
          - 200
misc changes 2021-01-02 04:59:06 +00:00			`id: CVE-2019-7609`
:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00
			`info:`
			`name: Kibana Timelion Arbitrary Code Execution`
			`author: dwisiswant0`
			`severity: critical`
Description and referenes 2021-03-30 12:10:17 +00:00			`description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Description and referenes 2021-03-30 12:10:17 +00:00			`- https://github.com/mpgn/CVE-2019-7609`
			`- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077`
Added tags to cves :sunglasses: (#813) * Added tags to cves :sunglasses: 2021-02-05 19:44:41 +00:00			`tags: cve,cve2019,kibana,rce`
:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00
			`requests:`
			`- method: POST`
			`path:`
			`- "{{BaseURL}}/api/timelion/run"`
			`headers:`
			`Content-Type: "application/json; charset=utf-8"`
removed extra headers not required for template 2021-09-08 12:17:19 +00:00
			`body: '{"sheet":[".es(*)"],"time":{"from":"now-1m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}'`

:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`words:`
			`- "seriesList"`
			`part: body`
removed extra headers not required for template 2021-09-08 12:17:19 +00:00
:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00			`- type: word`
			`words:`
removed extra headers not required for template 2021-09-08 12:17:19 +00:00			`- "application/json"`
:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00			`part: header`
removed extra headers not required for template 2021-09-08 12:17:19 +00:00
:fire: Add CVE-2019-7609 2020-08-15 18:10:27 +00:00			`- type: status`
			`status:`
			`- 200`