CVE-2023-31415: 
Kibana vulnerability analysis and mitigation

Kibana version 8.7.0 contains an arbitrary code execution vulnerability (CVE-2023-31415) discovered in May 2023. The vulnerability affects the Uptime/Synthetics feature, where an attacker with All privileges could send a request to execute JavaScript code, potentially leading to arbitrary command execution on the host system with Kibana process permissions (Elastic Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (NIST) and 9.9 CRITICAL (CISA-ADP) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It is classified as CWE-94 (Improper Control of Generation of Code) (NVD).

The vulnerability could allow attackers to execute arbitrary commands on the host system with the permissions of the Kibana process. For Elastic Cloud instances, the code execution is limited within the Kibana Docker container, with container escape prevented by seccomp-bpf and AppArmor profiles (Elastic Advisory).

Users are advised to upgrade to Kibana version 8.7.1 to address this vulnerability. For cloud deployments, additional security measures such as seccomp-bpf and AppArmor profiles provide containment of potential exploits (Elastic Advisory).