{"id":8553,"date":"2025-03-06T13:08:51","date_gmt":"2025-03-06T13:08:51","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/elastic-fixes-critical-kibana-rce-flaw\/"},"modified":"2025-03-06T13:08:52","modified_gmt":"2025-03-06T13:08:52","slug":"elastic-fixes-critical-kibana-rce-flaw","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/elastic-fixes-critical-kibana-rce-flaw\/","title":{"rendered":"Elastic Fixes Critical Kibana RCE Flaw"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 06, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Data Security \/ Software Security<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Elastic<\/b> has released security updates to address a critical security vulnerability affecting the Kibana<\/b> data visualization dashboard software for Elasticsearch<\/b>, which could lead to arbitrary code execution.<\/p>\n

The vulnerability, identified as CVE-2025-25012<\/strong>, has a CVSS score of 9.9 out of 10.0 and is classified as a prototype pollution vulnerability.<\/p>\n

“A case of prototype pollution in Kibana can lead to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests,” the company stated<\/a> in a security advisory released on Wednesday.<\/p>\n

A prototype pollution vulnerability<\/a> is a security flaw<\/a> that allows attackers to manipulate an application’s JavaScript objects and properties, potentially resulting in unauthorized data access, privilege escalation, denial-of-service, or remote code execution.<\/p>\n

The vulnerability affects all versions of Kibana between 8.15.0 and 8.17.3 and has been addressed in version 8.17.3.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

However, in Kibana versions from 8.15.0 to 8.17.1, the vulnerability can only be exploited by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2, it can only be exploited by users with the following privileges:<\/p>\n