Elastic Kibana

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Kibana arbitrary code execution via prototype pollution

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Kibana arbitrary code execution via prototype pollution

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Kibana Prototype Pollution can lead to code injection

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Kibana arbitrary code execution via prototype pollution

Kibana arbitrary code execution via YAML deserialization

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Kibana Insertion of Sensitive Information into Log File

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

Kibana Reporting vulnerabilities

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Kibana Improper Authorization

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Cross-Site Scripting (XSS)

Kibana Stored Cross-Site Scripting (XSS)

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Incorrect Authorization in Kibana Leading to Privilege Escalation

Kibana Stored Cross-Site Scripting (XSS)

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Incorrect Authorization in Kibana Leading to Privilege Escalation

Kibana Insertion of Sensitive Information into Log File

Kibana Insertion of Sensitive Information into Log File

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Kibana exposure of sensitive information to an unauthorized actor

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes.

Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service