CYPHERLOCK, INC.

Severe Kibana Flaw Enables Attackers to Run Unauthorized Code

Kibana, a widely-used open-source tool for data visualization and exploration, has discovered a severe security vulnerability that could enable attackers to run arbitrary code.

This issue, identified as CVE-2024-37287, has been given a CVSSv3 severity score of 9.9, signifying its high level of risk.

CVE-2024-37287 – Vulnerability Overview

The vulnerability stems from a prototype pollution issue, which can be exploited by attackers who have access to Machine Learning (ML) and Alerting connector features, along with write permissions to internal ML indices.

Successful exploitation of this flaw could allow attackers to execute arbitrary code, leading to serious security implications, as highlighted by Elastic Cloud.

Impacted Environments

This vulnerability affects multiple Kibana environments, including:

  • Self-managed Kibana installations on host Operating Systems.
  • Self-managed Kibana instances running via the Kibana Docker image: Here, Remote Code Execution (RCE) is contained within the Docker container, with further exploitation being mitigated by seccomp-bpf, which prevents container escape.
  • Kibana instances on Elastic Cloud: RCE is similarly restricted to the Kibana Docker container, with added protections from seccomp-bpf and AppArmor profiles.
  • Kibana instances on Elastic Cloud Enterprise (ECE): Like Elastic Cloud, RCE is limited to the Docker container, with seccomp-bpf and AppArmor profiles offering further safeguards.
  • Kibana instances on Elastic Cloud on Kubernetes (ECK): The RCE is contained within the Docker container, with seccomp-bpf offering protection against further exploitation when properly configured and supported (Kubernetes v1.19 and later).

Impacted Versions

Kibana VersionStatus
8.x < 8.14.2Affected
7.x < 7.17.23Affected

To address the risks associated with this vulnerability, it is highly recommended that users upgrade to Kibana version 8.14.2 or 7.17.23 immediately, as these versions include the necessary fixes.

This critical vulnerability highlights the need for prompt software updates and strong security measures. Organizations using Kibana should prioritize upgrading to the latest versions to protect their systems from potential threats.

For further details and guidance, users should consult the official Kibana documentation and security advisories.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day