exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Kibana 6.6.1 CSV Injection

Kibana 6.6.1 CSV Injection
Posted Jan 29, 2020
Authored by Aamir Rehman

Kibana version 6.6.1 suffers from a CSV injection vulnerability.

tags | exploit
SHA-256 | a79072142212672614328199a639b428a9f3f3037ca68d2e9881ff24fcea8b7d

Kibana 6.6.1 CSV Injection

Change Mirror Download
# Exploit Title: Kibana 6.6.1 - CSV Injection
# Google Dork: inurl:"/app/kibana" intitle:"Kibana"
# Date: 2020-01-15
# Exploit Author: Aamir Rehman
# Vendor Homepage: https://www.elastic.co/kibana
# Software Link: https://www.elastic.co/downloads/
# Version: v6.6.1 possibly latest versions
# Tested on: Kibana 6.6.1 - Firefox/Windows
# References:
# https://the-it-wonders.blogspot.com/2020/01/csv-injection-in-kibana-661-possibly.html
# https://github.com/elastic/kibana/issues/56081


# Software description:
Kibana is an open source data visualization dashboard for Elasticsearch. It provides visualization capabilities on top of the content indexed on an Elasticsearch cluster. Users can create bar, line and scatter plots, or pie charts and maps on top of large volumes of data.

# Technical Details & Impact:
Most of the kibana applications are having authentication disabled any malicious user can inject csv payload in visualization section of dashboard and It's possible to run malicious command on logged in user computer. Even though an alert message is shown on opening the file but users usually ignore such pop-ups since file is from known source.

# POC

1. Click on Dashboard tab and select any dashboard from the list. I would suggest to select the dashboard which has Gauge or Line visualization type.
2. Once you are on dashboard click on "Edit button" on top right of the page.
3. Click "gear (options)" button of any graphical view box.
4. It will open a options box click on "edit visualization".
5. It will open the edit page click on any "Blue play button" in front of any metric.
6. Here you can edit the metric's information; we will be exploiting the "Custom Label" field
7. In custom Label field enter your csv injection payload e.g. @SUM(1+1)*cmd|' /c calc'!A0.
8. All is done now click on Top "blue play button" to save the settings and click on SAVE button open top right of the page.
9. Go back to dashboard graphical view, you will see your csv payload their. Click on 3dots buttons on top of the graphical box click on "INSPECT".
10. It will open the export panel click on download csv and click formatted csv.

# Timeline
15-01-2020 - Vulnerability discovered
27-01-2020 - Vendor contacted
28-01-2020 - Vendor responded, not marking it as a security flaw. Git issue has been created. (https://github.com/elastic/kibana/issues/56081)
28-01-2020 – Requested vendor for disclosure.
29-01-2020 - Full Disclosure
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close