CVE-2018-17246 Code injection in Kibana
An attacker with Console API access can inject JavaScript to execute arbitrary commands on the host system via the Kibana Console plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-17246?
CVE-2018-17246 is a critical code injection vulnerability in Elastic Kibana, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Which versions are affected by CVE-2018-17246?
It affects 2 products.
Products include Elastic Kibana, Redhat Openshift Container Platform.
How do I fix CVE-2018-17246?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-17246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-17246 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-cpwf-64qm-2jpm.