QID 375877

Date Published: 2021-09-28

QID 375877: Kibana Multiple Security Vulnerabilities (ESA-2021-21, ESA-2021-22, ESA-2021-24)

Kibana is an open source data visualization plugin for Elasticsearch. It provides visualization capabilities on top of the content indexed on an Elasticsearch cluster. Users can create bar, line and scatter plots, or pie charts and maps on top of large volumes of data.

CVE-2021-22150: It was discovered that a user with fleet admin permissions could upload a malicious package.
CVE-2021-22151: It was discovered that Kibana was not validating a user supplied path, which would load .pbf files.
CVE-2021-22930, CVE-2021-3672, CVE-2021-22931, CVE-2021-22930, CVE-2021-22939: Kibana 7.14.1 upgrades Node.js to version 14.17.5 to resolve multiple issues there in Node.js version 14.17.3.

Affected Version:
All versions of Kibana before 7.14.1 are affected by this flaw

QID Detection Logic:(Authenticated)
This authenticated QID checks for Kibana version by running "/usr/share/kibana/bin/kibana --version" command.

QID Detection Logic:(Unauthenticated)
This QID sends a GET request to find if the target is running a vulnerable version of kibana.

Successful exploitation of these vulnerabilities may affect confidentiality, integrity and availability of the targeted user.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
  • Solution
    Vendor has released fix to this vulnerability.

    Customers are advised to refer to ESA-2021-21, ESA-2021-22 and ESA-2021-24 for more information.

    Software Advisories
    Advisory ID Software Component Link
    ESA-2021-21 URL Logo www.elastic.co/community/security
    ESA-2021-22 URL Logo www.elastic.co/community/security
    ESA-2021-24 URL Logo www.elastic.co/community/security