Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

An update of the kibana package has been released.

According to its self-reported version number, the Kibana application running on the remote host is prior to 5.6.15 or 6.x prior to 6.6.1. It is, therefore, affected by the following vulnerabilities:

 - A cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. (CVE-2019-7608)

 - An arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7609)

 - An arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7610)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Kibana versions before 5.6.15 and 6.6.1 have the following vulnerabilities:

- A cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. (CVE-2019-7608)
 - An arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7609)
 - An arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7610)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2860 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains updates to kibana in Red Hat OpenShift Container Platform 4.1.18.

    Security Fix(es):

    * kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana     users (CVE-2019-7608)

    * kibana: Arbitrary code execution flaw in the Timelion visualizer (CVE-2019-7609)

    * kibana: Audit logging Remote Code Execution issue (CVE-2019-7610)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Kibana versions before 5.6.15 and 6.6.1 have the following vulnerabilities:

  - A cross-site scripting (XSS) vulnerability that could     allow an attacker to obtain sensitive information from     or perform destructive actions on behalf of other     Kibana users. (CVE-2019-7608)

  - An arbitrary code execution flaw in the Timelion     visualizer. An attacker with access to the Timelion     application could send a request that will attempt to     execute javascript code. This could possibly lead to an     attacker executing arbitrary commands with permissions     of the Kibana process on the host system. (CVE-2019-7609)

  - An arbitrary code execution flaw in the security audit     logger. If a Kibana instance has the setting     xpack.security.audit.enabled set to true, an attacker     could send a request that will attempt to execute     javascript code. This could possibly lead to an attacker     executing arbitrary commands with permissions of the     Kibana process on the host system. (CVE-2019-7610)

ID	Name	Product	Family	Severity
203030	Photon OS 3.0: Kibana PHSA-2019-3.0-0014	Nessus	PhotonOS Local Security Checks	critical
98982	Kibana 6.x < 6.6.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98981	Kibana < 5.6.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
701234	Kibana 5.x < 5.6.15 / 6.x < 6.6.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
129396	RHEL 7 : OpenShift Container Platform 4.1.18 (RHSA-2019:2860)	Nessus	Red Hat Local Security Checks	critical
125082	Photon OS 2.0: Kibana PHSA-2019-2.0-0155	Nessus	PhotonOS Local Security Checks	critical
122589	Kibana ESA-2019-01, ESA-2019-02, ESA-2019-03	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-7610

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical