Elastic Kibana Workflows Code Injection Vulnerability Allowing File Read and SSRF

A vulnerability exists in the Workflows feature of Elastic Kibana 9.3.0, allowing authenticated users with the 'workflowsManagement:executeWorkflow' privilege to read arbitrary files from the Kibana server filesystem and perform Server-Side Request Forgery (SSRF) via code injection. This issue arises from improper neutralization of special elements used in a template engine, and the Workflows feature must be specifically enabled within Advanced Settings, as it is turned off by default.

Impact

Exploitation of this vulnerability could lead to unauthorized file access on the Kibana server and facilitate Server-Side Request Forgery attacks.

Remediation

Users can upgrade to Kibana 9.3.1, where this vulnerability is resolved. For those unable to upgrade, the Workflows feature can be disabled.