Kibana 7.0.x <= 7.17.29 / 8.0.x <= 8.18.7 / 8.19.x <= 8.19.3 / 9.0.x <= 9.0.6 / 9.1.x <= 9.1.3 XSS (ESA-2025-16)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(269973);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-25017");
  script_xref(name:"IAVB", value:"2025-B-0165-S");

  script_name(english:"Kibana 7.0.x <= 7.17.29 / 8.0.x <= 8.18.7 / 8.19.x <= 8.19.3 / 9.0.x <= 9.0.6 / 9.1.x <= 9.1.3 XSS (ESA-2025-16)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana running on the remote host is prior to 7.0 prior to 7.17.29, 8.0 prior to 8.18.7, 8.19 prior to 
8.19.3, 9.0 prior to 9.0.6 and 9.1 prior to 9.1.6. It is, therefore, affected by a cross-site scripting vulnerability 
as referenced in the ESA-2025-16 advisory.

  - Improper Neutralization of Input During Web Page Generation in Vega visualizations in Kibana can lead to 
    Cross-Site-Scripting (XSS). (CVE-2025-25017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?808e2ba6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Kibana version 8.18.8, 8.19.4, 9.0.7, 9.1.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-25017");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

get_install_count(app_name: 'Kibana', exit_if_zero: TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:'Kibana', port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '7.0.0', 'max_version' : '7.17.29', 'fixed_version' : '8.18.8' },
  { 'min_version' : '8.0.0', 'fixed_version' : '8.18.8' },
  { 'min_version' : '8.19.0', 'fixed_version' : '8.19.4' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.0.7' },
  { 'min_version' : '9.1.0', 'fixed_version' : '9.1.4' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);