CVE-2024-37288
📋 TL;DR
A deserialization vulnerability in Kibana allows arbitrary code execution when parsing malicious YAML documents. This only affects users who have enabled Elastic Security's built-in AI tools and configured an Amazon Bedrock connector. Attackers could execute code with Kibana's privileges.
💻 Affected Systems
- Kibana
📦 What is this software?
Kibana by Elastic
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining Kibana's privileges, potentially leading to data exfiltration, lateral movement, or ransomware deployment.
Likely Case
Unauthorized code execution within Kibana's context, allowing access to Elasticsearch data and potential privilege escalation.
If Mitigated
Limited impact due to network segmentation and proper access controls restricting Kibana's permissions.
🎯 Exploit Status
Exploitation requires access to Kibana interface and specific configuration
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kibana 8.15.1
Vendor Advisory: https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119
Restart Required: Yes
Instructions:
1. Download Kibana 8.15.1 from Elastic website. 2. Stop Kibana service. 3. Backup configuration and data. 4. Install updated version. 5. Restart Kibana service.
🔧 Temporary Workarounds
Disable Bedrock Connector
allRemove or disable Amazon Bedrock connector configuration
Navigate to Kibana Security settings and disable Bedrock connector
Disable Elastic Security AI Tools
allTurn off AI features in Elastic Security
Disable AI tools in Elastic Security configuration
🧯 If You Can't Patch
- Network segmentation to isolate Kibana instances
- Implement strict access controls and monitoring for Kibana
🔍 How to Verify
Check if Vulnerable:
Check if Kibana version is below 8.15.1 AND has Elastic Security AI tools enabled with Bedrock connector configuredCheck Version:
curl -X GET "localhost:5601/api/status" | grep "number"Verify Fix Applied:
Verify Kibana version is 8.15.1 or higher using version check command📡 Detection & Monitoring
Log Indicators:
- Unusual YAML parsing errors in Kibana logs
- Suspicious process execution from Kibana
Network Indicators:
- Unexpected outbound connections from Kibana host
SIEM Query:
source="kibana.log" AND ("YAML" OR "deserialization") AND error