CVE-2019-7609
Kibana Arbitrary Code Execution
Description
CVE-2019-7609 is a critical code injection vulnerability in Elastic Kibana, the data visualization frontend for Elasticsearch. The flaw exists in the Timelion visualizer component, where an attacker with access to the Timelion application can exploit a prototype pollution weakness to achieve arbitrary code execution on the Kibana server. Rated with a perfect CVSS 3.1 score of 10.0 (CRITICAL) and an EPSS score of 94.43% (99.98th percentile), this Kibana vulnerability represents a maximum-severity threat. CISA has confirmed active exploitation by adding CVE-2019-7609 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| elastic | kibana | < 5.6.15; >= 6.0.0, < 6.6.1 |
| redhat | openshift container platform | 3.11; 4.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHBA-2019:2824(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2019:2860(Third Party Advisory)
- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077(Vendor Advisory)
- https://www.elastic.co/community/security(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection in Elastic Kibana's Timelion visualizer occurs because user-supplied input is processed in a way that allows JavaScript prototype pollution, which can be leveraged to execute arbitrary code on the server. The Timelion expression parser fails to properly neutralize special elements in user input, enabling attackers to modify JavaScript object prototypes and ultimately execute arbitrary commands with the privileges of the Kibana process.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2019-7609 carries the maximum possible CVSS 3.1 score of 10.0 (CRITICAL), reflecting the worst-case combination of exploitability and impact factors. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no authentication and no user interaction. Critically, the scope is changed, meaning exploitation can affect resources beyond the Kibana application itself, including the underlying host operating system and connected Elasticsearch clusters. Confidentiality (High): attackers can access all data indexed in Elasticsearch, including potentially sensitive logs, metrics, and business data. Integrity (High): arbitrary command execution allows attackers to modify data, deploy malware, and manipulate system configurations. Availability (High): attackers can disrupt the entire Elastic Stack deployment or leverage the compromised host for further attacks. The EPSS score of 94.43% (99.98th percentile) indicates near-certain exploitation activity.
Exploit Maturity
CVE-2019-7609 has a highly mature exploit landscape with readily available weaponized tools. Public exploit code is available via Packet Storm Security, providing a complete prototype pollution to remote code execution chain. CISA has confirmed active exploitation by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-07-10. The EPSS score of 94.43% (99.98th percentile) represents near-certain exploitation probability, consistent with the availability of reliable public exploits and the trivial exploitation requirements of this Kibana code injection vulnerability.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Upgrade Kibana to version 5.6.15 or later for the 5.x branch, or version 6.6.1 or later for the 6.x branch, as detailed in the Elastic security advisory.
- If running Kibana on Red Hat OpenShift Container Platform 3.11 or 4.1, apply the relevant Red Hat errata updates (RHBA-2019:2824 and RHSA-2019:2860).
- As an interim mitigation, disable the Timelion visualizer if it is not actively used, or restrict access to Kibana to trusted users only using network-level access controls and authentication proxies.
- Monitor Kibana server logs for indicators of compromise, including unusual Timelion expressions, unexpected child process creation, and outbound network connections from the Kibana process.
- Implement runtime application protection and restrict the Kibana process to least-privilege execution to limit the impact of any successful code injection.
Technical Details
CVE-2019-7609 exploits a prototype pollution vulnerability in the Timelion visualizer component of Elastic Kibana versions before 5.6.15 and 6.6.1. The attack leverages specially crafted Timelion expressions that manipulate JavaScript object prototypes through the expression parser, ultimately achieving arbitrary code execution. The prototype pollution technique allows an attacker to inject properties into base JavaScript object prototypes, which are then inherited by other objects in the application, including those used in child process creation. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms the maximum severity: network-accessible, low complexity, no authentication required, no user interaction needed, and the scope is changed meaning the attacker can break out of the Kibana application context to execute commands on the host system with the full privileges of the Kibana process.
Frequently Asked Questions
Is CVE-2019-7609 being actively exploited?
Yes. CVE-2019-7609 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.43% (99.98th percentile) indicates near-certain exploitation activity, and public exploit code is readily available on Packet Storm Security.
What products are affected by CVE-2019-7609?
CVE-2019-7609 affects Elastic Kibana versions prior to 5.6.15 and versions 6.0.0 through 6.6.0. Additionally, Red Hat OpenShift Container Platform versions 3.11 and 4.1 that ship bundled Kibana are also affected.
How do I fix CVE-2019-7609?
Upgrade Kibana to version 5.6.15 or later (for 5.x) or version 6.6.1 or later (for 6.x). If immediate patching is not possible, disable the Timelion visualizer or restrict network access to the Kibana interface to trusted users only.
How severe is CVE-2019-7609?
CVE-2019-7609 has the maximum possible CVSS 3.1 score of 10.0 (CRITICAL). It allows unauthenticated remote code execution with no user interaction required, and the scope is changed meaning attackers can compromise the underlying host system. The EPSS score of 94.43% places it in the 99.98th percentile of exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.