Description
该漏洞源于 Kibana 中的原型污染问题，攻击者可以通过精心构造的文件上传和特定的 HTTP 请求绕过验证机制，攻击者利用该漏洞后，可以在受影响的系统上执行任意代码，可能导致数据泄露、系统被完全控制等严重后果
Elastic Kibana 原型污染致任意代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.nsfocus.net/elastic-kibana/
https://www.secrss.com/articles/78450
https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868
https://nvd.nist.gov/vuln/detail/CVE-2025-25014
https://nsfocusglobal.com/elastic-kibana-prototype-contamination-leads-to-arbitrary-code-execution-vulnerability-cve-2025-25014/
https://security.snyk.io/vuln/SNYK-JS-KIBANA-9376712
https://www.51cto.com/article/815100.html
https://cn-sec.com/archives/4040121.html
https://www.secevery.com/toBugInfo?id=1897930308940775425
https://starmap.dbappsecurity.com.cn/info/10064
https://github.com/advisories/ghsa-r96x-p6v3-j823