11 mincritical
Release the RAVEN: Kibana Under Siege
RAVEN is an offensive security tool that automates the full attack lifecycle against Kibana instances. It exploits CVE-2019-7609 (Timelion prototype pollution RCE, CVSS 10.0) using a novel browser-trigger technique that pre-caches the Canvas template before pollution, then uses headless Chromium to trigger worker process forks that execute the payload. It also exploits CVE-2018-17246 (LFI, CVSS 9.8) where file contents are disclosed through Kibana error logs rather than HTTP responses, evading response-based detection. A third module extracts dashboards, embedded credentials, and saved objects without requiring any CVE exploitation.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2018-17246Local file inclusion via the Console plugin's require() mechanism allows an attacker to read arbitrary files, with contents disclosed through SyntaxError log entries.
- cveCVE-2019-7609Prototype pollution in the Timelion .es() query parser allows an attacker to set Object.prototype.env properties that execute arbitrary code when Kibana forks a child process.
- filename/proc/self/environUsed in the CVE-2019-7609 exploit chain as the NODE_OPTIONS --require target. The process environment is read as a JavaScript module, which contains the polluted prototype variable holding the child_process.exec payload.
- filename/tmp/rce_proofProof-of-concept file created by the Timelion RCE payload to verify code execution. In real attacks, the output redirection target would differ, but the pattern of writing command output to /tmp is common.
- pypi_packageraven-esOffensive security tool RAVEN distributed on PyPI. Provides automated Kibana reconnaissance, CVE exploitation, and intelligence extraction modules. Command-line entry point is raven-es.
Detection / Hunteropenrouter
What Happened
A security research team has built a tool called RAVEN that automatically attacks Kibana, a popular dashboard and visualization interface used alongside Elasticsearch databases. The tool can identify Kibana versions and installed plugins, exploit two critical vulnerabilities to read server files or execute commands remotely, and extract sensitive data like dashboard configurations and embedded passwords. One of the vulnerabilities (CVE-2019-7609) is listed on CISA's Known Exploited Vulnerabilities catalog and has a maximum severity score of 10.0. Organizations running outdated Kibana versions or Kibana without authentication should patch immediately and restrict access to port 5601. The tool is publicly available, which increases the likelihood of adoption by attackers.
Key Takeaways
- RAVEN is an offensive security tool with three Kibana modules (kb-recon, kb-cve, kb-loot) that automate reconnaissance, CVE exploitation, and intelligence extraction against Kibana instances on port 5601.
- CVE-2019-7609 (Timelion prototype pollution RCE, CVSS 10.0, KEV-listed) is fully automated by RAVEN using a novel three-step chain: pre-cache the Canvas template, deliver the prototype pollution payload, then trigger Canvas rendering via headless Chromium to fork a worker process that executes the payload.
- CVE-2018-17246 (LFI, CVSS 9.8) discloses file contents indirectly through Kibana's SyntaxError log entries rather than HTTP responses, making response-based detection ineffective and enabling retrieval via centralized log aggregation pipelines.
- The kb-loot module extracts dashboards, embedded credentials, and all saved objects from Kibana's saved_objects API without requiring any CVE exploitation, only requiring valid credentials or unauthenticated access.
- Kibana's plugin list serves as a target map: Canvas enables the Timelion RCE trigger, Console exposes the LFI path, and Reporting has SSRF history.
Affected Systems
- Kibana before 6.4.3 (CVE-2018-17246 LFI via Console plugin)
- Kibana before 5.6.15 and 6.0.0 through 6.6.0 (CVE-2019-7609 Timelion prototype pollution RCE)
- Kibana instances with no authentication configured
- Elasticsearch/Kibana deployments with centralized log aggregation via Filebeat or Logstash
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2019-7609 | Kibana Timelion visualizer (Kibana before 5.6.15 and 6.0.0 through 6.6.0) | Critical | Prototype pollution in the Timelion .es() query parser allows an attacker to set Object.prototype.env properties that execute arbitrary code when Kibana forks a child process. |
| CVE-2018-17246 | Kibana Console plugin (Kibana before 6.4.3) | Critical | Local file inclusion via the Console plugin's require() mechanism allows an attacker to read arbitrary files, with contents disclosed through SyntaxError log entries. |
Attack Chain
- Reconnaissance: RAVEN's kb-recon module queries /api/status to fingerprint Kibana version, build, installed plugins, authentication state, and API access levels.
- Vulnerability Detection: kb-cve module checks the detected Kibana version against a CVE catalog to identify applicable vulnerabilities (CVE-2018-17246 LFI, CVE-2019-7609 Timelion RCE).
- Exploitation (LFI): CVE-2018-17246 is exploited by sending a crafted request to the Console plugin that triggers require() on a target file. File contents appear in SyntaxError log entries, not in HTTP responses.
- Exploitation (RCE): CVE-2019-7609 is exploited in three steps: (a) pre-cache the Canvas template via GET to /app/canvas, (b) deliver prototype pollution payload via POST to /api/timelion/run, (c) trigger Canvas rendering via headless Chromium to fork worker processes that inherit poisoned NODE_OPTIONS and execute the payload.
- Intelligence Extraction: kb-loot module queries the saved_objects API to extract dashboards, hunt for embedded credentials, and export all saved objects without requiring CVE exploitation.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide detection rules. It describes detection challenges and gaps, noting that CVE-2018-17246 LFI produces 500 errors visible to WAFs and SyntaxErrors visible in log monitoring, but neither looks like a file read without contextual correlation.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would see child process creation from Kibana's Node.js process if the Timelion RCE is triggered. The LFI exploitation does not spawn new processes, so EDR visibility is limited to file access patterns by the Kibana process. The browser trigger uses headless Chromium, which may or may not be monitored depending on EDR configuration. |
| Network Visibility | Medium | Network monitoring would see HTTP requests to /api/status, /api/timelion/run, /app/canvas, and the saved_objects API. The LFI exploit returns a 500 error. The Timelion RCE payload is delivered via a POST to /api/telion/run. However, if Kibana is accessed over HTTPS with no inspection, payload contents would not be visible. |
| Detection Difficulty | Hard | The LFI disclosure happens in logs, not HTTP responses, requiring correlation between web access logs and Kibana application logs. The Timelion RCE payload is a single POST that returns 200, and the actual execution happens in a child process triggered by a separate browser navigation to /app/canvas. The three-step chain (pre-cache, pollute, trigger) spans multiple requests that are not obviously connected. The kb-loot module uses legitimate API endpoints with valid credentials, making it indistinguishable from normal usage without behavioral baselining. |
Required Log Sources
- Kibana application logs (for SyntaxError entries indicating LFI)
- Web server/reverse proxy access logs for port 5601
- Process creation logs (for child processes spawned by Kibana Node.js process)
- Network flow logs for port 5601
- Filebeat/Logstash logs (if log aggregation ships disclosed file contents to Elasticsearch)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for POST requests to /api/timelion/run containing prototype pollution patterns such as Object.prototype assignments or NODE_OPTIONS references, which would indicate CVE-2019-7609 exploitation attempts. | Web server access logs, reverse proxy logs, WAF logs for port 5601 | Exploitation | Low. Legitimate Timelion queries do not typically contain Object.prototype or NODE_OPTIONS strings. |
| Consider hunting for SyntaxError entries in Kibana application logs that contain file path patterns or file contents (such as root:x:), which would indicate CVE-2018-17246 LFI exploitation. | Kibana application logs, centralized log aggregation indices | Exploitation | Low. SyntaxErrors containing file system paths or passwd entries are not expected in normal Kibana operation. |
| Consider hunting for the sequence of a GET request to /app/canvas followed by a POST to /api/timelion/run followed by another GET to /app/canvas within a short time window, which would indicate the RAVEN browser-trigger exploit chain for CVE-2019-7609. | Web server access logs, reverse proxy logs for port 5601 | Exploitation | Medium. Legitimate users may access Canvas and Timelion in sequence, but the specific order and timing pattern is unusual. |
| Consider hunting for bulk access to the Kibana saved_objects API that retrieves large numbers of objects or searches for credential patterns, which would indicate intelligence extraction via the kb-loot module or similar tooling. | Kibana access logs, API audit logs, Elasticsearch query logs | Collection | Medium. Administrators and power users may legitimately export saved objects, but automated bulk extraction with credential pattern matching is atypical. |
| Consider hunting for child processes spawned by the Kibana Node.js process, particularly shell commands or processes writing to /tmp, which would indicate successful RCE via CVE-2019-7609. | EDR process creation logs, auditd, sysmon for Linux | Execution | Low. Kibana does not typically spawn shell child processes during normal operation. |
Control Gaps
- Web Application Firewalls monitoring HTTP responses would not detect CVE-2018-17246 LFI since file contents are disclosed in logs, not response bodies.
- Response-based monitoring sees only a 500 error for the LFI exploit and a 200 for the Timelion RCE payload, neither of which indicates file read or code execution without log correlation.
- Network-based detection without TLS inspection would not see payload contents in HTTPS requests to Kibana.
- Authentication-based access controls do not prevent kb-loot extraction if the attacker has valid credentials or if Kibana has no authentication configured.
- The pre-cache step in the Timelion RCE chain appears as a normal GET request to /app/canvas, making the three-step exploit chain difficult to correlate without behavioral analytics.
Key Behavioral Indicators
- GET request to /api/status from non-browser user agents or automated tools (reconnaissance)
- POST to /api/timelion/run containing Object.prototype or NODE_OPTIONS strings (prototype pollution payload)
- Sequence: GET /app/canvas, POST /api/timelion/run, GET /app/canvas within minutes (RAVEN browser-trigger chain)
- SyntaxError in Kibana logs containing file paths or file contents (LFI disclosure)
- Child process spawned by Kibana Node.js process executing shell commands (successful RCE)
- Bulk requests to saved_objects API retrieving multiple object types in rapid succession (intelligence extraction)
- Headless Chromium process launched on a Kibana server (browser trigger artifact)
False Positive Assessment
Low
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider patching Kibana to version 6.4.3 or later to remediate CVE-2018-17246, and to version 6.6.1 or later (or 5.6.15) to remediate CVE-2019-7609.
- If patching is not immediately possible, consider restricting access to port 5601 to trusted internal networks only, blocking external access entirely.
- Consider disabling the Timelion plugin if it is not required by your business operations, which would eliminate the CVE-2019-7609 attack vector.
- Consider reviewing Kibana saved objects for embedded credentials, API keys, and connection strings that could be extracted by an attacker with access.
Infrastructure Hardening
- Evaluate whether Kibana authentication is enforced. If Kibana is running without authentication, enable it immediately.
- Consider placing Kibana behind a reverse proxy with authentication and TLS termination, enabling inspection of requests to port 5601.
- If your organization uses centralized log aggregation for Kibana logs via Filebeat or Logstash, consider whether the logs index is accessible to unauthorized users, as disclosed file contents from CVE-2018-17246 would be stored there.
- Consider implementing network segmentation to isolate Elasticsearch and Kibana from general corporate network access.
- Evaluate whether headless browser processes (Chromium) on Kibana servers would be detected by your endpoint monitoring, as this is a key artifact of the automated RCE trigger.
User Protection
- Consider deploying EDR or process monitoring on Kibana servers to detect child process creation from the Node.js process, which would indicate successful RCE.
- If your EDR supports process ancestry tracking, consider alerting on shell processes (sh, bash) whose parent is the Kibana Node.js process.
- Consider implementing rate limiting on Kibana API endpoints, particularly /api/timelion/run and the saved_objects API, to slow automated exploitation and extraction.
Security Awareness
- Consider educating development and operations teams about the risk of embedding credentials in Kibana visualizations and data source configurations.
- Consider adding Kibana version and plugin inventory checks to existing vulnerability management processes, as the plugin list directly maps to exploitable CVEs.
- If your organization conducts penetration testing, consider requesting that Kibana on port 5601 be included in scope, as the article notes it is frequently unexamined.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Additional IOCs
- File Paths:
/tmp/rce_proof- Proof-of-concept file created by the Timelion RCE payload to verify code execution. In real attacks, the output redirection target would differ, but the pattern of writing command output to /tmp is common./proc/self/environ- Used in the CVE-2019-7609 exploit chain as the NODE_OPTIONS --require target. The process environment is read as a JavaScript module, which contains the polluted prototype variable holding the child_process.exec payload.
- Command Lines:
- Purpose: Kibana reconnaissance: fingerprint version, plugins, authentication state, and API access | Tools:
raven-es| Stage: Reconnaissance |raven-es --quiet -t <target> kb-recon - Purpose: Kibana CVE checking against detected version | Tools:
raven-es| Stage: Vulnerability Detection |raven-es --quiet -t <target> kb-cve --check-only - Purpose: CVE-2018-17246 LFI exploitation to read arbitrary files via Console plugin | Tools:
raven-es| Stage: Exploitation |raven-es --quiet -t <target> kb-cve --lfi <filepath> --confirm-writes - Purpose: CVE-2019-7609 Timelion prototype pollution RCE with automated browser trigger | Tools:
raven-es,Playwright,headless Chromium| Stage: Exploitation - Purpose: Extract dashboard definitions from Kibana saved_objects API | Tools:
raven-es| Stage: Intelligence Extraction |raven-es --quiet -t <target> kb-loot --dashboards - Purpose: Search Kibana saved objects for embedded credentials | Tools:
raven-es| Stage: Intelligence Extraction |raven-es --quiet -t <target> kb-loot --hunt-creds - Purpose: Export all Kibana saved objects to local file for offline analysis | Tools:
raven-es| Stage: Intelligence Extraction |raven-es --quiet -t <target> kb-loot --export <path>
- Purpose: Kibana reconnaissance: fingerprint version, plugins, authentication state, and API access | Tools: