Elastic Kibana Denial-of-Service Vulnerability Due to Improper Input Validation

A denial-of-service vulnerability has been identified in Elastic Kibana versions 8.18.0 prior to 8.19.12, as well as in the 9.x series, specifically versions 9.0.0 prior to 9.2.6 and 9.3.0. This vulnerability arises from improper validation of input quantities, allowing an authenticated attacker with view-only privileges to manipulate input data. The exploitation of this vulnerability leads to excessive resource consumption, causing Kibana to become unresponsive or crash.

Impact

Exploitation of this vulnerability causes Kibana to become unresponsive or crash, disrupting service and availability.

Remediation

Users can upgrade to Kibana versions 8.19.12, 9.2.6, or 9.3.1 to address this vulnerability. For those unable to upgrade, it is recommended to monitor Kibana server resource usage, restrict access to trusted users, and consider implementing application-layer request size limits if possible.