CVE-2024-43708
📋 TL;DR
This vulnerability allows authenticated users with read access to Kibana to send specially crafted payloads that cause resource exhaustion, leading to Kibana service crashes. It affects Kibana instances where users can access UI inputs, potentially causing denial of service.
💻 Affected Systems
- Kibana
📦 What is this software?
Kibana by Elastic
Kibana by Elastic
⚠️ Risk & Real-World Impact
Worst Case
Complete Kibana service outage affecting all users, requiring service restart and potentially causing data loss if crashes occur during critical operations.
Likely Case
Intermittent Kibana crashes affecting availability, requiring administrator intervention to restart services and restore functionality.
If Mitigated
Limited impact with proper monitoring and automated recovery systems in place, though service interruptions may still occur.
🎯 Exploit Status
Requires authenticated user access but payload construction appears straightforward based on vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kibana 7.17.23 and 8.15.1
Vendor Advisory: https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548
Restart Required: Yes
Instructions:
1. Backup Kibana configuration and data. 2. Stop Kibana service. 3. Upgrade to Kibana 7.17.23 or 8.15.1. 4. Restart Kibana service. 5. Verify service is running correctly.
🔧 Temporary Workarounds
Restrict User Access
allLimit Kibana access to only essential users and review permissions to minimize attack surface.
Implement Rate Limiting
allConfigure reverse proxy or load balancer to limit request rates to Kibana endpoints.
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual request patterns
- Deploy Kibana behind WAF with request size and rate limiting rules
🔍 How to Verify
Check if Vulnerable:
Check Kibana version via Settings > About in Kibana UI or run 'kibana --version' command.Check Version:
kibana --versionVerify Fix Applied:
Verify Kibana version is 7.17.23 or higher for 7.x branch, or 8.15.1 or higher for 8.x branch.📡 Detection & Monitoring
Log Indicators:
- Kibana process crashes
- Out of memory errors in Kibana logs
- Unusually large request payloads
Network Indicators:
- Multiple large POST requests to Kibana endpoints from single users
- Sudden drop in Kibana service availability
SIEM Query:
source="kibana.log" AND ("out of memory" OR "process crashed" OR "allocation failure")