Kibana 8.7.0 < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.3 Authorization Bypass (ESA-2026-59)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330370);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2026-56147");
  script_xref(name:"IAVB", value:"2026-B-0199");

  script_name(english:"Kibana 8.7.0 < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.3 Authorization Bypass (ESA-2026-59)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an authorization bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.7.0 prior to 8.19.18, or 9.3.x prior to 9.3.7, or 9.4.x
prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-59 advisory.

  - Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information
    disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in
    Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify,
    and delete case attachments that belong to feature areas they are not authorized to access. Because the
    access control check and the resource retrieval use different resolution mechanisms, an authenticated
    attacker with limited file management permissions can obtain the contents of, modify, or delete protected
    case attachments - such as those associated with Security Solution cases - without holding the privileges
    required to access those features. (CVE-2026-56147)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4577c3ab");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.18, 9.3.7, 9.4.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56147");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.7.0', 'fixed_version' : '8.19.18' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.7' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.3' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);