Arbitrary Code Execution in Kibana by Elastic

CVE-2023-31414

Summary

Kibana versions 8.0.0 through 8.7.0 are susceptible to an arbitrary code execution vulnerability. This flaw allows an attacker with write access to the Kibana YAML or environment configuration files to inject a malicious payload. Upon execution, this payload could run JavaScript code, enabling the attacker to execute arbitrary commands on the host machine with the same permissions as the Kibana process. This vulnerability emphasizes the importance of securing configuration files and managing user permissions to mitigate potential risks.

References