CVE-2024-37288: 
Kibana vulnerability analysis and mitigation

A critical deserialization vulnerability in Kibana (CVE-2024-37288) was discovered that can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. The vulnerability specifically affects users who utilize Elastic Security's built-in AI tools and have configured an Amazon Bedrock connector. The issue was disclosed on September 9, 2024, affecting Kibana version 8.15.0 (NVD, Elastic Forums).

The vulnerability is rated with a CVSS v3.1 base score of 9.9 (Critical) according to Elastic's assessment, with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue is classified as CWE-502 (Deserialization of Untrusted Data). The vulnerability specifically manifests when processing YAML documents through the Amazon Bedrock Connector component (NVD, Security Online).

If successfully exploited, the vulnerability allows attackers to execute arbitrary code on affected systems, potentially leading to complete system compromise. The high severity rating indicates the potential for significant impact on system confidentiality, integrity, and availability (Security Online).

Users are strongly advised to upgrade to Kibana version 8.15.1 or higher to address this vulnerability. For users unable to upgrade immediately, a temporary mitigation is available by disabling the integration assistant using the configuration setting 'xpack.integration_assistant.enabled: false' in the kibana.yml file (Elastic Forums).