Kibana < 7.17.29 / 8.x < 8.17.18 / 8.18.x < 8.18.3 / 9.x < 9.0.3 Multiple Vulnerabilities (ESA-2025-09, ESA-2025-10)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241439);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/07");

  script_cve_id("CVE-2025-2135", "CVE-2025-25012");

  script_name(english:"Kibana < 7.17.29 / 8.x < 8.17.18 / 8.18.x < 8.18.3 / 9.x < 9.0.3 Multiple Vulnerabilities (ESA-2025-09, ESA-2025-10)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana running on the remote host is prior to 7.17.29, 8.x prior to 8.17.18, 8.18.x prior to 8.18.3, or
9.x prior to 9.0.3. It is, therefore, affected by multiple vulnerabilities:

  - Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap
    corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2025-2135)

  - URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and
    server-side request forgery via a specially crafted URL. (CVE-2025-25012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-09/379443
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?98762b23");
  # https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2d5a9065");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Kibana version 7.17.29, 8.17.18, 8.18.3, or 9.0.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-2135");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana", "Settings/ParanoidReport");
  script_require_ports("services/www", 5601);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Kibana', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version':'7.17.29'},
        {'min_version':'8.0.0', 'fixed_version':'8.17.8'},
        {'min_version':'8.18.0', 'fixed_version':'8.18.3'},
        {'min_version':'9.0.0', 'fixed_version':'9.0.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);