Elastic Kibana Missing Authorization Vulnerability in Detection Rule Management Allowing Unauthorized Endpoint Response Actions

A vulnerability exists in Kibana's server-side Detection Rule Management due to missing authorization. This flaw can enable an authenticated attacker with rule management privileges to improperly configure endpoint response actions, such as host isolation, process termination, and process suspension. The vulnerability arises from accessing functionality not properly constrained by access control lists (ACLs).

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of detection rules, allowing for improper endpoint response actions to be executed.

Remediation

Users can upgrade to Kibana versions 8.19.12, 9.2.6, or 9.3.1 to address this vulnerability. For those unable to upgrade, it is recommended to restrict detection rule management privileges to users who are also authorized for endpoint response actions and to review existing rules for any unauthorized response action configurations that may have been added by unauthorized users.