CVE-2025-37732: 
Kibana vulnerability analysis and mitigation

CVE-2025-37732 is a stored Cross-Site Scripting (XSS) vulnerability in Elastic Kibana's integration package upload functionality, classified under CWE-79. It allows an authenticated user with low privileges to inject and render malicious HTML tags within other users' browsers. This issue bypasses the previously released fix for ESA-2025-17 (CVE-2025-25018) to achieve HTML injection. Affected versions include Kibana 7.0.0–7.17.29, 8.0.0–8.19.7, 9.0.0–9.1.7, and 9.2.0–9.2.1. It was published on December 15, 2025, with a CVSS v3.1 base score of 5.4 (Medium) (Elastic Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically within Kibana's integration package upload feature. An authenticated attacker can craft a malicious integration package that, when uploaded and rendered, injects HTML tags into the browser of any user who views the affected content. This vulnerability is notable because it bypasses the sanitization fix introduced for the related CVE-2025-25018 (ESA-2025-17), indicating an incomplete remediation of the original XSS attack surface. Exploitation requires low privileges and user interaction (a victim must view the injected content), with the scope marked as changed, meaning the impact extends beyond the attacker's own session (Elastic Advisory).

Successful exploitation allows an attacker to execute malicious HTML/script content in the context of another user's browser session within Kibana. This can lead to session cookie theft, session hijacking, unauthorized actions performed on behalf of the victim, and capture of sensitive information displayed in the Kibana interface. Both confidentiality and integrity are impacted at a low level, with no direct availability impact; however, the changed scope means the attack can affect users beyond the attacker's own session (Elastic Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Elastic Advisory). The EPSS score is approximately 0.028%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection coverage is available via Tenable Nessus plugin 278978.

1. Reconnaissance: Identify a Kibana instance running a vulnerable version (7.0.0–7.17.29, 8.0.0–8.19.7, 9.0.0–9.1.7, or 9.2.0–9.2.1) and obtain low-privilege authenticated access.
2. Craft malicious package: Prepare an integration package file containing HTML injection payloads (e.g., <img src=x onerror=alert(document.cookie)> or similar) embedded in fields that are rendered in the Kibana UI, designed to bypass the existing sanitization introduced for CVE-2025-25018.
3. Upload the package: Use the integration package upload functionality within Kibana to upload the crafted package while authenticated.
4. Trigger victim interaction: Wait for or socially engineer a higher-privileged user to navigate to the page or component where the malicious package content is rendered.
5. Achieve objective: The injected HTML executes in the victim's browser, enabling session cookie theft, session hijacking, or other malicious actions on behalf of the victim (Elastic Advisory).

• Logs: Kibana access logs showing unusual integration package upload requests from low-privilege accounts, particularly with unexpected or malformed package content; audit logs recording package uploads by accounts not typically performing such actions.
• Network: Outbound requests from victim browsers to attacker-controlled domains following interaction with Kibana integration package pages (e.g., exfiltration of cookies or session tokens).
• Application Behavior: Unexpected HTML rendering or script execution errors appearing in Kibana UI pages related to integration package display; users reporting unexpected browser behavior or redirects after viewing integration content.

Elastic has released patched versions addressing CVE-2025-37732: Kibana 8.19.8, 9.1.8, and 9.2.2. Users on the 7.x branch (7.0.0–7.17.29) should consult the Elastic advisory for guidance, as that branch may be end-of-life. The primary recommended action is to upgrade to a fixed version immediately. As interim mitigations, organizations should restrict access to the integration package upload functionality to trusted administrators only, enforce Content Security Policy (CSP) headers, and audit recent integration package uploads for suspicious content (Elastic Advisory).

The vulnerability was noted in threat intelligence aggregators and security community feeds shortly after disclosure on December 15, 2025, including coverage by Rewterz in a multi-vulnerability Elastic advisory roundup (Rewterz Advisory). Community reaction has been measured given the medium severity and lack of public exploit code. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability tracking and advisory dissemination.