Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-43706
CVE-2024-43706:
Kibana vulnerability analysis and mitigation
Overview
A high-severity vulnerability (CVE-2024-43706) has been identified in Kibana's Synthetic Monitoring feature. The vulnerability affects Kibana versions 8.12.0 and older, allowing potential privilege abuse through direct HTTP requests to Synthetic monitor endpoints. The flaw was discovered and disclosed by Elastic, with a CVSS score of 7.6, indicating high severity (SecurityOnline, Elastic Discuss).
Technical details
The vulnerability stems from improper authorization checks on the synthetics endpoint. In affected versions, users with lower privileges can potentially access Synthetic monitor functionality through direct API requests, bypassing role-based restrictions enforced in the user interface. The vulnerability has been assigned a CVSS score of 7.6 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/CR:M/IR:M/AR:M (Elastic Discuss).
Impact
The vulnerability could result in unauthorized data visibility or service misuse, depending on how the monitor is configured. The flaw affects both self-hosted deployments and those running on Elastic Cloud, potentially allowing attackers to bypass user interface constraints and access data or trigger actions without appropriate authorization (SecurityOnline).
Mitigation and workarounds
Elastic has released version 8.12.1 which patches this vulnerability. For users unable to upgrade, several workarounds are available: For self-hosted deployments, users can disable Synthetics Monitoring by adding 'xpack.uptime.enabled: false' to their kibana.yml file, or apply an index block on synthetics- indices to make them read-only. For Elastic Cloud users, applying a read-only block on all synthetics- indices through index management is recommended (Elastic Discuss).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management