PT-2025-2667 · Elastic · Kibana
Published
2025-01-23
·
Updated
2025-01-28
·
CVE-2024-43710
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Kibana (affected versions not specified)
Description
A server side request forgery issue was identified in Kibana where the "/api/fleet/health check" API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
Recommendations
As a temporary workaround, consider restricting access to the "/api/fleet/health check" API endpoint until a patch is available.
Restrict access to internal endpoints available over HTTPS that return JSON to minimize the risk of exploitation.
Avoid using the "/api/fleet/health check" API endpoint with users who have read access to Fleet until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kibana