TL;DR
Elastic has released a critical security update for Kibana, addressing a vulnerability that allows arbitrary code execution through prototype pollution. Users are urged to upgrade to version 8.17.3 or apply mitigation strategies to prevent exploitation.
Critical Kibana Flaw: Elastic Patches Code Execution Vulnerability
Elastic has addressed a critical vulnerability in Kibana, the data visualization dashboard software for Elasticsearch, which could lead to arbitrary code execution. Tracked as CVE-2025-25012 with a CVSS score of 9.9, this flaw poses a significant security risk.
Understanding Kibana and Elasticsearch
Kibana is a powerful visualization tool that works with Elasticsearch to create insightful visualizations from indexed data. Users can generate various charts and maps to analyze large volumes of data effectively.
Vulnerability Overview
The vulnerability allows attackers to execute arbitrary code by uploading a specially crafted file and using specifically crafted HTTP requests. This type of attack, known as prototype pollution, manipulates an object’s prototype in JavaScript applications, leading to unexpected behavior and security risks.
Prototype Pollution is a class of vulnerabilities in JavaScript runtimes that allows attackers to overwrite arbitrary properties in an object's prototype. In a prototype pollution attack, attackers inject properties into existing JavaScript construct prototypes, trying to compromise the application.
Impacted Versions and Mitigation
The flaw affects Kibana versions between 8.15.0 and 8.17.3. Elastic has released version 8.17.3 to address this issue. Here are the specific impacts:
- Kibana 8.15.0 to 8.17.1: Vulnerable to users with the Viewer role.
- Kibana 8.17.1 and 8.17.2: Vulnerable to users with `fleet-all`, `integrations-all`, and `actions:execute-advanced-connectors` privileges.
For users who cannot upgrade immediately, setting `xpack.integration_assistant.enabled: false` in Kibana’s configuration can mitigate the risk.
Stay Informed
Follow Pierluigi Paganini on [Twitter](https://twitter.com/securityaffairs), [Facebook](https://www.facebook.com/sec.affairs), and [Mastodon](https://infosec.exchange/@securityaffairs) for the latest updates on cybersecurity.
Additional Resources
For further insights, check:
- [Cybersecurity & Data Protection Affairs: Elastic Kibana Critical Flaw](https://securityaffairs.com/174999/security/elastic-kibana-critical-flaw.html)
- [Prototype Pollution Prevention Cheat Sheet - OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html)
Stay vigilant and ensure your systems are protected against this critical vulnerability.