Kibana 8.12.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-102 / ESA-2026-108)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338738);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72653", "CVE-2026-72661");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 8.12.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-102 / ESA-2026-108)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.12.x prior to 8.19.19, 9.0.x prior to 9.3.8, or 9.4.x prior
to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-102 and ESA-2026-108
advisories.

  - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality
    Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic
    Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its
    user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the
    permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no
    Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data,
    could read endpoint response action records and the corresponding response content returned by managed
    hosts. (CVE-2026-72661)

  - Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via
    Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows
    could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive
    resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.
    (CVE-2026-72653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-102/389513
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc3771a0");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-108/389514
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aab77eab");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.19, 9.3.8, 9.4.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72653");

  script_cwe_id(770, 862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.12.0', 'fixed_version' : '8.19.19' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.8' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.4' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);