Kibana Unrestricted File Upload Vulnerability Leading to Cross-Site Scripting

A vulnerability in Kibana allowing unrestricted upload of files with dangerous types can lead to arbitrary execution of JavaScript in a victim's browser, resulting in cross-site scripting (XSS). This issue arises from the ability to upload crafted HTML and JavaScript files. The vulnerability affects Kibana versions 7.17.6 prior to 7.17.24 and 8.4.0 prior to 8.11.4. To exploit this vulnerability, an attacker must have access to the Synthetics app or the ability to write to the synthetics indices.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute malicious JavaScript in the context of the victim's browser.

Remediation

Users can upgrade to Kibana versions 7.17.24 or 8.12.0 to address this vulnerability.