CVE-2019-13423 Auth bypass in Search Guard Kibana Plugin

What is CVE-2019-13423?

CVE-2019-13423 is a high-severity authentication bypass vulnerability in floragunn Search Guard Kibana Plugin, published on 23 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time

Weakness: CWE-287

Which versions are affected by CVE-2019-13423?

It affects 1 product.

Products include Search-Guard Search Guard.

How do I fix CVE-2019-13423?

No fix has been published for CVE-2019-13423 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-13423 being exploited?

There is no known exploitation of CVE-2019-13423 in the wild and no public exploit code.

Other vulnerabilities in floragunn Search Guard Kibana Plugin

• CVE-2019-13419 Information disclosure in Search Guard High 7.5
• CVE-2019-13418 Information disclosure in Search Guard High 7.5
• CVE-2019-13415 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data Medium 6.5
• CVE-2019-13416 Missing authorization in Search Guard Medium 6.5
• CVE-2019-13422 Open redirect in Search Guard Kibana Plugin Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fxmc-8m6x-7f33.