Collected research

Exploiting prototype pollution - RCE in Kibana

Exploiting prototype pollution - RCE in Kibana (CVE-2019-7609)

@SecurityMB · research.securitum.com · 30 October 2019

Turns prototype pollution into remote code execution in Kibana. A Timelion expression that assigns through an object's prototype pollutes Object.prototype, and Kibana's Canvas then spawns a node child process whose environment the attacker now controls, setting NODE_OPTIONS to require /proc/self/environ so another injected variable runs as JavaScript.

Record

Document

Exploiting prototype pollution - RCE in Kibana (CVE-2019-7609)

Researcher

@SecurityMB

Published by

research.securitum.com

Date

30 October 2019

Topic

Injection

In the archive

• Collected in the 2019 research round

Related sources

• Prototype pollution in Kibana Slides
• Very creative way to turn Prototype Pollution into RCE in kibana - Bug Bounty Reports Explained

Tags

• prototype-pollution
• rce
• gadget-chain
• nodejs
• elasticsearch
• javascript
• injection
• cve
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of @SecurityMB, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.