Elastic Releases Urgent Fix for Critical Kibana Vulnerability Enabling Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37285 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token NVD description · AI analysis pending | 7.2 | 1% |
| — | ||
| CVE-2024-37287 | A flaw allowing arbitrary code execution was discovered in Kibana. A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution. NVD description · AI analysis pending | 7.2 | 2% |
| — | ||
| CVE-2024-37288 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html . NVD description · AI analysis pending | 8.8 | 1% |
| — | ||
| CVE-2025-25012 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. NVD description · AI analysis pending | 5.4 | <1% |
| — | ||
| CVE-2025-25015 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors NVD description · AI analysis pending | 9.9 | 1% |
| — |
Full article377 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 06, 2025Data Security / Software Security
Elastic has rolled out security updates to address a critical security flaw impacting the Kibana data visualization dashboard software for Elasticsearch that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2025-25015, carries a CVSS score of 9.9 out of a maximum of 10.0. It has been described as a case of prototype pollution.
"Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests," the company said in an advisory released Wednesday.
Prototype pollution vulnerability is a security flaw that allows attackers to manipulate an application's JavaScript objects and properties, potentially leading to unauthorized data access, privilege escalation, denial-of-service, or remote code execution.
The vulnerability affects all versions of Kibana between 8.15.0 and 8.17.3. It has been addressed in version 8.17.3.
That said, in Kibana versions from 8.15.0 and prior to 8.17.1, the vulnerability is exploitable only by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2, it can only be exploited by users that have all the below-mentioned privileges -
- fleet-all
- integrations-all
- actions:execute-advanced-connectors
Elastic further noted that the issue only impacts Kibana instances running on Elastic Cloud but emphasized code execution is limited within the Kibana Docker container and that further exploitation such as container escape is prevented by seccomp-bpf and AppArmor profiles. It does not affect self-managed Kibana instances on Basic or Platinum licences.
Users are advised to take steps to apply the latest fixes to safeguard against potential threats. In the event immediate patching is not an option, users are recommended to set the Integration Assistant feature flag to false ("xpack.integration_assistant.enabled: false") in Kibana's configuration ("kibana.yml").
In August 2024, Elastic addressed another critical prototype pollution flaw in Kibana (CVE-2024-37287, CVSS score: 9.9) that could lead to code execution. A month later, it resolved two severe deserialization bugs (CVE-2024-37288, CVSS score: 9.9 and CVE-2024-37285, CVSS score: 9.1) that could also permit arbitrary code execution.
(The story was updated after publication to reflect the change in CVE identifier. A previous version of Elastic's advisory referenced the vulnerability as CVE-2025-25012.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/elastic-releases-urgent-fix-for.html