CVE-2024-37288: Kibana Deserialization Arbitrary Code Execution
Summary
CVE-2024-37288: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. Affects elk versions >= 8.15.0, < 8.15.1. Fixed in 8.15.1. How to fix ↓
Also tracked for
- kibana · Bitnami
The same CVE-2024-37288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kibana is an open-source data visualization and exploration tool designed for Elasticsearch. It provides a user-friendly interface for analyzing and visualizing data stored in Elasticsearch indices. Kibana is widely used in various industries for monitoring and analyzing data. However, a vulnerability has been discovered in Kibana that can lead to arbitrary code execution under specific conditions.
Vulnerability Detail
The vulnerability in Kibana is related to a deserialization issue. When Kibana attempts to parse a YAML document containing a crafted payload, it can result in arbitrary code execution. This vulnerability specifically affects users who utilize Elastic Security's built-in AI tools and have configured an Amazon Bedrock connector. The issue arises due to improper handling of the YAML document, allowing an attacker to inject malicious code and potentially gain unauthorized access or perform unauthorized actions on the affected system. The severity of this vulnerability is classified as critical, with a CVSS v3 score of 9.8 (Critical).
How To Fix
Minimum fixed version
8.15.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Kibana.
Conclusion
The vulnerability in Kibana allows for arbitrary code execution when parsing a crafted YAML document. Users who utilize Elastic Security's built-in AI tools and have configured an Amazon Bedrock connector are at risk. Upgrading to Kibana version 8.15.1 or later is necessary to fix this vulnerability and ensure the security of the system.
See every vulnerability recorded for elk →
FAQ
Kibana is an open-source data visualization and exploration tool designed for Elasticsearch. It provides a user-friendly interface for analyzing and visualizing data stored in Elasticsearch indices.
Users who utilize Elastic Security's built-in AI tools and have configured an Amazon Bedrock connector are affected by this vulnerability.
The vulnerability can lead to arbitrary code execution, potentially allowing an attacker to gain unauthorized access or perform unauthorized actions on the affected system.
To fix this vulnerability, it is recommended to upgrade to Kibana version 8.15.1 or later.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Kibana.
References
Related vulnerabilities
Recent vulnerabilities recorded for elk.
