Kibana code execution issue (ESA-2021-21)

It was discovered that a user with fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the kibana server.

Affected Versions:
Kibana versions 7.10.2 through 7.14.0

Solutions and Mitigations:
Users should upgrade to Kibana version 7.14.1

CVSSv3: 6.6 - AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2021-22150

Kibana path traversal issue (ESA-2021-22)

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

Thanks to Luat Nguyen of CyberJutsu for reporting this issue.

Affected Versions:

Kibana versions before 7.14.0

Solutions and Mitigations:
Users should upgrade to Kibana version 7.14.1

CVSSv3: 3.1 - AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE ID: CVE-2021-22151

Kibana html injection issue (ESA-2021-23)

It was discovered that kibana was not sanitizing document fields containing html snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

Affected Versions:

Kibana version 7.14.0

Solutions and Mitigations:

Users can set “doc_table:highlight” to “false” in the Kibana Advanced Settings. Users who do not wish to do this, and are currently on version 7.14.0 should upgrade to version 7.14.1.

CVSSv3: 4.3 - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE ID: CVE-2021-37936

Kibana Node.js security vulnerabilities (ESA-2021-24)

Node.js version 14.17.3 is affected by several security vulnerabilities: CVE-2021-22930, CVE-2021-3672, CVE-2021-22931, CVE-2021-22930, and CVE-2021-22939. We do not believe an attacker can exploit these against Kibana, but we are upgrading Node.js out of an abundance of caution. Kibana 7.14.1 upgrades Node.js to version 14.17.5 to resolve these issues.

Affected Versions:

Kibana versions before 7.14.1

Solutions and Mitigations:

Users should upgrade to Kibana version 7.14.1

CVSSv3:
CVE ID: CVE-2021-22930, CVE-2021-3672, CVE-2021-22931, CVE-2021-22930, CVE-2021-22939

Elasticsearch privilege escalation issue (ESA-2021-25)

An issue was found with how API keys are created with the fleet-server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised fleet-server service account could escalate themselves to a super-user.

Affected Versions:
Elasticsearch versions from 7.13.0 through 7.14.0

Solutions and Mitigations:

Users should upgrade to Elasticsearch version 7.14.1

CVSSv3: 5.9 - AV:N/AC:H/PR:H/U

Additional Information

Liferay's Elasticsearch connectors and out-of-the-box features are not using API keys.