# N/A
## 漏洞概述
Kibana 在 Timelion 视图器中存在一个任意代码执行漏洞，允许攻击者执行JavaScript代码，从而可能执行任意命令。
## 影响版本
- 低于 5.6.15 的 5.x 系列版本
- 低于 6.6.1 的 6.x 系列版本
## 漏洞细节
攻击者可以利用 Timelion 应用以发送请求，这些请求将尝试执行JavaScript代码。这可能导致攻击者在宿主机系统上以Kibana进程的权限执行任意命令。
## 影响
可能允许攻击者在宿主机系统上以Kibana进程的权限执行任意命令。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | kibana < 6.6.0 未授权远程代码命令执行 (Need Timelion And Canvas),CVE-2019-7609 | https://github.com/jas502n/kibana-RCE | POC详情 |
| 2 | RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizer | https://github.com/mpgn/CVE-2019-7609 | POC详情 |
| 3 | exploit CVE-2019-7609(kibana RCE) on right way by python2 scripts | https://github.com/LandGrey/CVE-2019-7609 | POC详情 |
| 4 | None | https://github.com/hekadan/CVE-2019-7609 | POC详情 |
| 5 | None | https://github.com/rhbb/CVE-2019-7609 | POC详情 |
| 6 | Kibana Prototype Pollution | https://github.com/dnr6419/CVE-2019-7609 | POC详情 |
| 7 | docker lab setup for kibana-7609 | https://github.com/wolf1892/CVE-2019-7609 | POC详情 |
| 8 | Kibana <6.6.0 RCE written in python3 | https://github.com/Cr4ckC4t/cve-2019-7609 | POC详情 |
| 9 | None | https://github.com/OliveiraaX/CVE-2019-7609-KibanaRCE | POC详情 |
| 10 | Exploit for CVE-2019-7609 in python | https://github.com/Akshay15-png/CVE-2019-7609 | POC详情 |
| 11 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7609.yaml | POC详情 |
| 12 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Kibana%20%E5%8E%9F%E5%9E%8B%E9%93%BE%E6%B1%A1%E6%9F%93%E5%AF%BC%E8%87%B4%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-7609.md | POC详情 |
| 13 | https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2019-7609/README.md | POC详情 |