Kibana 8.x < 8.19.18 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Path Traversal (ESA-2026-158)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344321);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/10");

  script_cve_id("CVE-2026-78590");
  script_xref(name:"IAVB", value:"2026-B-0244");

  script_name(english:"Kibana 8.x < 8.19.18 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Path Traversal (ESA-2026-158)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.x prior to 8.19.18, or 9.0.x prior to 9.3.6, or 9.4.x prior to
9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-158 advisory.

  - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet
    feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A
    low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to
    act on unintended internal resources, resulting in the deletion of privileged resources such as user
    accounts and other organizational assets. Exploitation requires an administrator to interact with the
    affected Fleet interface. (CVE-2026-78590)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?adf72399");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.18, 9.3.6, 9.4.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78590");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.18' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.6' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.3' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);