PT-2023-6647 · Elastic · Kibana

Published 2023-09-18 · Updated 2023-11-03 · CVE-2023-31422

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana version 8.10.0

Description The issue impacts Kibana when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern, allowing sensitive information to be recorded in logs in the event of an error. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana system, kibana-metricbeat, or Kibana end-users.

Recommendations For Kibana version 8.10.0, update to Kibana 8.10.1 to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation. Avoid using the JSON layout or the %meta pattern in the pattern layout until the issue is resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-07417

CVE-2023-31422

Affected Products

Kibana

References · 11

• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31422 · Security Note
• https://bdu.fstec.ru/vul/2023-07417 · Security Note
• https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31422 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31422 · Note
• https://t.me/cvenotify/60023 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1717411663597404343 · Twitter Post
• https://t.me/cvenotify/60486 · Telegram Post
• https://twitter.com/CVEnew/status/1717365707543883898 · Twitter Post
• https://t.me/cibsecurity/72937 · Telegram Post