CVE-2020-7012

EIP tracks 1 public exploit for CVE-2020-7012. PoCs published by h00die, Alex Brasetvik (alexbrasetvik), including Metasploit module exploits/linux/http/kibana_upgrade_assistant_telemetry_rce.

AI-analyzed exploit summary This Metasploit module exploits a prototype pollution vulnerability in Kibana's Upgrade Assistant (CVE-2020-7012) to achieve remote code execution by injecting malicious telemetry data. The exploit leverages either direct Elasticsearch access or Kibana's dev console to implant payloads, which execute when Kibana processes the polluted prototype.

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.