Kibana Vulnerabilities Allow SSRF and DOM-Based XSS Exploitation

EXECUTIVE SUMMARY:

Researchers uncovered two security vulnerabilities in Kibana, the visualization dashboard component of the Elastic Stack, which could allow attackers to perform server-side request forgery and DOM-based cross-site scripting attacks. The flaws affect multiple versions of Kibana deployed on both Elastic Cloud and self-hosted environments. The first issue, caused by improper origin validation in the Observability AI Assistant, could allow attackers to send forged HTTP requests to access internal data. The second, more severe issue lies in Kibana’s Vega visualization engine, where inadequate input sanitization could enable execution of malicious JavaScript code in the victim’s browser. Since Vega is enabled by default, nearly all Kibana instances are at risk unless administrators disable the feature. Elastic has patched these issues in latest versions, urging all users to update or apply temporary mitigations immediately.