id: CVE-2019-7609

info:
  name: Kibana Timelion Arbitrary Code Execution
  author: dwisiswant0
  severity: critical
  description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference: |
    - https://github.com/mpgn/CVE-2019-7609
    - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
  tags: cve,cve2019,kibana,rce

  # Kibana versions before 5.6.15 and 6.6.1
  # contain an arbitrary code execution flaw in the Timelion visualizer.
  # An attacker with access to the Timelion application could send a request
  # that will attempt to execute javascript code.
  # This could possibly lead to an attacker executing arbitrary commands
  # with permissions of the Kibana process on the host system.

requests:
  - method: POST
    path:
      - "{{BaseURL}}/api/timelion/run"
    headers:
      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
      Content-Type: "application/json; charset=utf-8"
    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "seriesList"
        part: body
      - type: word
        words:
          - "Content-Type: application/json"
        part: header
      - type: status
        status:
          - 200