Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338742);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72660");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.8, or 9.4.x prior to
9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-101 advisory.

  - Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to
    denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only
    low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data.
    The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates
    the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition
    can be triggered repeatedly. (CVE-2026-72660)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-3-8-and-9-4-5-security-update-esa-2026-101/389517
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ec3f03f6");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.20, 9.3.8, 9.4.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72660");

  script_cwe_id(20, 248);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.20' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.8' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.5' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);