nuclei-templates/cves/2019/CVE-2019-7609.yaml

40 lines
1.7 KiB
YAML

id: CVE-2019-7609
info:
name: Kibana Timelion Arbitrary Code Execution
author: dwisiswant0
severity: critical
description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
reference: |
- https://github.com/mpgn/CVE-2019-7609
- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
tags: cve,cve2019,kibana,rce
# Kibana versions before 5.6.15 and 6.6.1
# contain an arbitrary code execution flaw in the Timelion visualizer.
# An attacker with access to the Timelion application could send a request
# that will attempt to execute javascript code.
# This could possibly lead to an attacker executing arbitrary commands
# with permissions of the Kibana process on the host system.
requests:
- method: POST
path:
- "{{BaseURL}}/api/timelion/run"
headers:
User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
Content-Type: "application/json; charset=utf-8"
body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
matchers-condition: and
matchers:
- type: word
words:
- "seriesList"
part: body
- type: word
words:
- "Content-Type: application/json"
part: header
- type: status
status:
- 200