ID:9308 - Exploit for Code Injection in Kibana - CVE-2019-7609

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Timelion visualizer. A remote attacker with access to the Timelion application can send a specially crafted request and execute arbitrary javascript code on the target system with privileges of the Kibana process on the host system.

Remediation