Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338735);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72643");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an incorrect authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is,
therefore, affected by a vulnerability as referenced in the ESA-2026-124 advisory.

  - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier
    when one is recorded, and falling back to a comparison of the username when it is not. A username is not
    unique across Elasticsearch authentication realms, so two distinct principals that share a username in
    different realms are treated as the same owner. This discloses the configuration and instructions of an
    agent the caller does not own, and allows that agent to be altered or removed. (CVE-2026-72643)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9851340");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 9.4.5, 9.5.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72643");

  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.5' },
  { 'min_version' : '9.5.0', 'fixed_version' : '9.5.1' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);