Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338741);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72670", "CVE-2026-72671");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore,
affected by multiple vulnerabilities as referenced in the ESA-2026-87 and ESA-2026-88 advisories.

  - A lower privileged user who holds only the privilege to read agent policies can read the entire
    configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read
    settings.The proxy configuration possibly contains proxy authentication credentials and private key
    material that they should not be authorized to view. (CVE-2026-72670)

  - A Kibana Machine Learning capability that removes a saved object from the current space accepts machine
    learning trained models as a target, but it verifies only the privileges that apply to anomaly detection
    jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame
    analytics jobs without the trained model privilege can therefore remove a trained model from a space. The
    model itself is not deleted and remains available in its other spaces, and the change can be reversed by a
    suitably privileged user. (CVE-2026-72671)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7481e2ff");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c7847f2");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.20, 9.4.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72670");

  script_cwe_id(200, 862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.20' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.4.5' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);