kibana

RAVEN is an offensive security tool that automates the full attack lifecycle against Kibana instances. It exploits CVE-2019-7609 (Timelion prototype pollution RCE, CVSS 10.0) using a novel browser-trigger technique that pre-caches the Canvas template before pollution, then uses headless Chromium to trigger worker process forks that execute the payload. It also exploits CVE-2018-17246 (LFI, CVSS 9.8) where file contents are disclosed through Kibana error logs rather than HTTP responses, evading response-based detection. A third module extracts dashboards, embedded credentials, and saved objects without requiring any CVE exploitation.

LevelBlue SpiderLabs has released RAVEN, an open-source offensive security framework with 19 modules targeting Elasticsearch and Kibana environments. The tool automates reconnaissance, credential brute-forcing, exploitation of 8 tracked CVEs (three in CISA's KEV catalog, CVSS up to 10.0), Kibana-specific attacks, data exfiltration, and persistence via rogue users and long-lived API keys. Defenders should treat the release of this tool as an indicator that adversaries now have a consolidated, purpose-built toolkit for attacking exposed Elasticsearch/Kibana infrastructure.