Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338736);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72666", "CVE-2026-72672");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5. It is, therefore, affected by multiple
vulnerabilities as referenced in the ESA-2026-89 and ESA-2026-97 advisories.

  - The Elastic Security capability that suggests existing field values while a user authors endpoint policy
    artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the
    account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch
    index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read
    access to the Elastic Defend event indices can therefore retrieve field values from that data, including
    process command line arguments, which commonly contain tokens, credentials, connection strings, and other
    sensitive operational detail from protected hosts. (CVE-2026-72672)

  - Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query
    execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to,
    via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run
    Osquery live queries in one space can have a query carried out on hosts belonging to another space,
    resulting in disclosure of information from those hosts to the Osquery results data stream.
    (CVE-2026-72666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5619e249");
  # https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?02cb6f56");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 9.4.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72672");

  script_cwe_id(639, 863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '9.1.0', 'fixed_version' : '9.4.5' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);