CVE-2025-25014 PoC — Kibana arbitrary code execution via prototype pollution

Source

https://github.com/davidxbors/CVE-2025-25014

Associated Vulnerability

Title:Kibana arbitrary code execution via prototype pollution (CVE-2025-25014)
Description:A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Readme

# POC for CVE-2025-25014

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
Currently this POC **only detects** vulnerable instances.

## Usage

```bash
python CVE-2025-25014.py -u username -p password --proxy proxy_url url 
```

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →