Kibana EUVD-2024-54667

CVSS 7.6 (High) with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L indicates: (1) Network-exploitable with low complexity, (2) requires low privileges (PR:L)—a key constraint limiting blast radius, (3) high confidentiality impact but lower integrity/availability impact. The low PR requirement is the critical limiting factor; this is not a zero-privilege attack. Cross-referencing signals: The CVSS vector suggests moderate-to-high real-world risk if Kibana instances have numerous low-privilege users (e.g., junior analysts, read-only operators). However, without active KEV designation confirmation or public POC availability in this analysis context, exploitation likelihood may be lower than the CVSS score suggests. Organizations with strict least-privilege policies and role separation will see lower practical risk. The vulnerability merits immediate patching in multi-user Kibana deployments where privilege separation matters, but is not an emergency zero-day in single-operator environments.

An attacker gains a low-privilege Kibana account (e.g., via credential compromise, social engineering, or as a legitimate junior analyst). The attacker directly issues HTTP requests to Kibana's synthetic monitor endpoints (e.g., POST /api/synthetics/monitors or similar), crafting payloads to create, modify, or delete synthetic monitors, or to exfiltrate synthetic monitoring data (test results, performance metrics). Because authorization checks are improper, the endpoint accepts the request despite the user lacking synthetic monitor admin privileges. The attacker could: (a) modify monitor configurations to redirect traffic or disable critical uptime checks, (b) extract sensitive monitoring data revealing infrastructure details, or (c) create resource exhaustion by deploying numerous monitors. No UI interaction is required; the attack is entirely programmatic, making it automatable and suitable for lateral privilege escalation in compromised multi-user Kibana environments.