CVE-2024-37285: Kibana arbitrary code execution via YAML deserialization
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them.
The following Elasticsearch indices permissions are required
write privilege on the system indices .kibanaingest The allowrestrictedindices flag is set to true
Any of the following Kibana privileges are additionally required
Under Fleet the All privilege is granted Under Integration the Read or All privilege is granted Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37285?
CVE-2024-37285 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2024-37285?
To mitigate CVE-2024-37285, upgrade Kibana to the latest security patch provided by Elastic.
What type of vulnerability is CVE-2024-37285?
CVE-2024-37285 is a deserialization vulnerability that affects Kibana.
What are the requirements for exploiting CVE-2024-37285?
A successful exploitation of CVE-2024-37285 requires specific Elasticsearch indices privileges by a malicious user.
Which software is affected by CVE-2024-37285?
CVE-2024-37285 affects Elastic Kibana across unspecified versions.