RAVEN

RAVEN is an offensive tool targeting Elasticsearch deployments that enables bulk data exfiltration, credential-independent persistence via API keys, and multi-layered backdoor mechanisms. The tool exfiltrates data through Scroll/PIT API pagination or stealthier server-side snapshot operations. Persistence is established through rogue superuser accounts, non-expiring API keys, and Elasticsearch Watcher scheduled tasks that automatically recreate deleted backdoor components.

RAVEN is an offensive security tool that automates the full attack lifecycle against Kibana instances. It exploits CVE-2019-7609 (Timelion prototype pollution RCE, CVSS 10.0) using a novel browser-trigger technique that pre-caches the Canvas template before pollution, then uses headless Chromium to trigger worker process forks that execute the payload. It also exploits CVE-2018-17246 (LFI, CVSS 9.8) where file contents are disclosed through Kibana error logs rather than HTTP responses, evading response-based detection. A third module extracts dashboards, embedded credentials, and saved objects without requiring any CVE exploitation.

LevelBlue SpiderLabs released RAVEN, a Python-based offensive security tool for comprehensive Elasticsearch cluster reconnaissance and assessment. The tool automates fingerprinting, deep reconnaissance, anonymous access detection, index enumeration, secret hunting, credential brute-forcing, and privilege escalation analysis. The blog demonstrates RAVEN against lab environments running Elasticsearch 7.17.22, showing how an attacker can pivot from a single open port (9200) to full cluster compromise through unauthenticated API access, exposed credentials in indices, and default credential usage.

LevelBlue SpiderLabs has released RAVEN, an open-source offensive security framework with 19 modules targeting Elasticsearch and Kibana environments. The tool automates reconnaissance, credential brute-forcing, exploitation of 8 tracked CVEs (three in CISA's KEV catalog, CVSS up to 10.0), Kibana-specific attacks, data exfiltration, and persistence via rogue users and long-lived API keys. Defenders should treat the release of this tool as an indicator that adversaries now have a consolidated, purpose-built toolkit for attacking exposed Elasticsearch/Kibana infrastructure.