Ismisepaul

Improper input validation in the Kibana Fleet agent policy management feature allows an authenticated user with Fleet management privileges to escalate privileges. By injecting values into a configuration override mechanism that lacks adequate validation, an attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges. This may grant unauthorized read and write access to sensitive Elasticsearch security indices, exceeding the intended permissions of the Fleet management role.

An authenticated user with connector management privileges can perform a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. This allows the user to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations that egress controls were intended to block.

Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. An authenticated user can send a specially crafted compressed request payload that is processed before authorization checks, resulting in excessive memory and CPU consumption that may cause the instance to become unresponsive or crash.

An authenticated low-privileged user can cause a denial of service by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. This leads to uncontrolled resource consumption through excessive allocation, where the resulting data structure grows without bound, exhausting available memory and causing the service to crash.

Server-Side Request Forgery (SSRF) allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause the system to issue outbound requests to destinations that egress restriction controls were intended to block.

Improper neutralization of input during web page generation allows for stored HTML injection. A user with write access to an Elasticsearch index can persist crafted markup that is not sufficiently sanitized when rendered through a Kibana view by another user. This can lead to unauthorized UI manipulation and outbound network requests issued from the browser session of the user viewing the content.

Uncontrolled Resource Consumption in Kibana can lead to a denial of service via Excessive Allocation. An authenticated user with a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

A logic error in the validation of expiration timestamps allows a time-bounded access token to remain usable after its intended validity window has closed. This enables an unauthenticated actor who possesses the token to retrieve associated content after the token has expired, leading to unauthorized information disclosure.

A path traversal issue exists in the dashboard management functionality. An authenticated user with limited permissions can create a dashboard using a specially crafted identifier. If an administrator attempts to delete this dashboard, the request is redirected to an unintended internal endpoint, which may lead to the unauthorized deletion of user accounts or other resources.

Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. This causes the system to consume excessive CPU and memory resources during processing, rendering Kibana unavailable to all users until the service is manually recovered.

Improper Verification of Cryptographic Signature occurs in the Elastic Package Registry. This issue allows an attacker who can intercept network traffic or influence the content served to a self-hosted registry to substitute a tampered package without the integrity check failing closed.

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified) Description An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users. This issue is due to excessive allocation. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Kibana versions (affected versions not specified) Description Kibana One Workflow contains a Server-Side Request Forgery (CWE-918) issue that can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Execution with unnecessary privileges in the debug route handlers of the Fleet plugin allows an authenticated user to read index data beyond their direct Elasticsearch RBAC (Role-Based Access Control) scope. This issue occurs when a user possesses Fleet sub-feature privileges, such as those for agents, agent policies, and settings management, enabling them to abuse these privileges to access unauthorized data.

An improper validation of the quantity specified in input within the Timelion visualization plugin can lead to a denial of service through excessive allocation. An authenticated user can send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value. This issue is related to CAPEC-130 and CWE-1284.

A missing authorization issue (CWE-862) exists in Kibana’s server-side Detection Rule Management. This can allow an authenticated attacker with rule management privileges to perform unauthorized endpoint response actions, including host isolation, process termination, and process suspension, exploiting CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). The issue involves improper access control restrictions, potentially allowing unauthorized configuration changes.

A memory allocation issue exists within the Prometheus remote write HTTP handler in Metricbeat. This issue, categorized as excessive allocation (CAPEC-130), can lead to a denial of service (CWE-789). The problem stems from a memory allocation with an excessively large size value.

An improper validation of array index can lead to a denial of service through input data manipulation. An attacker positioned on the same network segment as the Packetbeat deployment, or controlling traffic routed to monitored interfaces, can send specially crafted, malformed network packets to a monitored network interface. This can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion.

An issue exists in the Timelion component that allows for Denial of Service through manipulation of input data, resulting in uncontrolled resource consumption. This can lead to a disruption of service.

An attacker with view-only privileges can cause a Denial of Service through Input Data Manipulation. A specially crafted payload can lead to excessive resource consumption, potentially making Kibana unresponsive or causing it to crash. The issue stems from improper validation of the specified quantity in input.