CVE-2023-31415 Code injection in Kibana

Critical 9.9 Published 4 May 2023 Updated 29 Jan 2025

An attacker with Uptime/Synthetics privileges can execute arbitrary JavaScript, leading to remote code execution on the host system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-31415?

CVE-2023-31415 is a critical code injection vulnerability in Elastic Kibana, published on 4 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Weakness: CWE-94

Which versions are affected by CVE-2023-31415?

It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2023-31415?

No fix has been published for CVE-2023-31415 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-31415 being exploited?

There is no known exploitation of CVE-2023-31415 in the wild and no public exploit code.

All Elastic Kibana vulnerabilities

Sources

Also known as GHSA-3x5p-xwf4-5g93.