Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344303);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/10");

  script_cve_id("CVE-2026-78592");
  script_xref(name:"IAVB", value:"2026-B-0244");

  script_name(english:"Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to
9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160
advisory.

  - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead
    to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user
    holding tag creation privileges could cause a subsequent administrative action in the tag management
    interface to act on an unintended target, resulting in the deletion of privileged resources including
    administrative accounts and other organizational assets. Exploitation requires an administrator to interact
    with the affected interface. (CVE-2026-78592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f2939c80");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.16, 9.3.5, 9.4.2 or later. Note that no fix is available for the 7.x release branch;
refer to the vendor advisory for details.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78592");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '7.11.0', 'max_version' : '7.17.29', 'fixed_display' : 'See vendor advisory' },
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.16' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.5' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.2' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);