CVE-2024-37288 Deserialization in Kibana
Attackers can execute arbitrary code via crafted YAML payloads in Kibana when Elastic Security AI tools with Amazon Bedrock connectors are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37288?
CVE-2024-37288 is a critical unsafe deserialization vulnerability in Elastic Kibana, published on 9 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
Weakness: CWE-502
Which versions are affected by CVE-2024-37288?
2 open source packages ship an affected version, including kibana and elk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | From 8.15.0 | 8.15.1 |
elk Bitnami | From 8.15.0 | 8.15.1 |
Products include Elastic Kibana.
How do I fix CVE-2024-37288?
Upgrade kibana to 8.15.1 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-37288 being exploited?
There is no known exploitation of CVE-2024-37288 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as BIT-elk-2024-37288, BIT-kibana-2024-37288, GHSA-ph9f-2c4w-rghv.