Vulnerability in Kibana Trigger RCE To Attackers Gain Super Access Remotely

A critical security vulnerability has been identified in Kibana, a popular data visualization and exploration tool used with Elasticsearch.

The flaw, designated as CVE-2024-37287, allows for arbitrary code execution through a prototype pollution vulnerability. This issue has been classified as critical, with a CVSSv3.1 severity rating of 9.1.

The vulnerability is a prototype pollution vulnerability that can be triggered by an attacker with access to the Machine Learning (ML) and Alerting connector features, as well as write access to internal ML indices. This can lead to arbitrary code execution, allowing attackers to take control of the affected system.

The flaw, which has been assigned the CVE ID CVE-2024-37287, allows an attacker with access to ML and Alerting connector features and write access to internal ML indices to trigger a prototype pollution vulnerability.

To exploit this vulnerability, an attacker must have:

• Write access to the .ml-anomalies* hidden indices.
• Read access to the Machine Learning feature.
• Read access to the Actions & Connectors feature.

This vulnerability can ultimately lead to arbitrary code execution within the Kibana container. However, security measures like seccomp-bpf and AppArmor profiles in most environments prevent further exploitation, such as container escape.

According to the Elastic report, “A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.”

Affected Systems

The vulnerability affects Kibana 8.x versions prior to 8.14.2 and Kibana 7.x versions from 7.7.0 prior to 7.17.23. The exploit requires a threat actor to have write access to the .ml-anomalies* hidden indices, read access to the Machine Learning feature, and read access to the Actions & Connectors feature.

The vulnerability impacts various configurations of Kibana:

• Self-Managed Kibana Installations: These are affected on host operating systems.
• Kibana Docker Images: While the remote code execution (RCE) is limited within the container, further exploitation is prevented by seccomp-bpf.
• Elastic Cloud Instances: RCE is contained within the Kibana Docker container, with additional protections from seccomp-bpf and AppArmor profiles.
• Elastic Cloud Enterprise (ECE) and Elastic Cloud on Kubernetes (ECK): Similar containment measures are in place, with Kubernetes v1.19 and later offering additional security.

It is important to note that write access to the .ml-anomalies* hidden indices is not provided by default and is not recommended or required for any user functionality.

Vulnerable Versions:

• Kibana 8.x versions prior to 8.14.2
• Kibana 7.x versions from 7.7.0 to 7.17.23

Mitigation Strategies

For users unable to upgrade, several mitigation strategies are recommended:

1. Secure Elasticsearch User Privileges: Ensure that users do not have unnecessary privileges, particularly write access to ML result indices (.ml-anomalies*).
2. Restrict Kibana User Privileges: Limit access to ML and connector action capabilities by setting the relevant Kibana privileges to “None” for users who do not require them.
3. Disable Connector Actions: Disable email connector actions in kibana.yml to prevent alerting rule notifications from being sent via email.
4. Disable Machine Learning: Disable ML capabilities entirely by setting xpack.ml.enabled: false in elasticsearch.yml and kibana.yml.

Given the critical nature of this vulnerability, organizations using Kibana are urged to take immediate action to secure their systems. The potential impact of arbitrary code execution underscores the importance of maintaining up-to-date software and implementing robust security measures.

Users are strongly advised to upgrade to Kibana version 8.14.2 or 7.17.23 to mitigate this vulnerability.