CVE-2024-43706
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-10-01
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | to 8.12.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2024-43706 is an improper authorization vulnerability in Kibana (up to version 8.12.0) that allows an attacker with low privileges to abuse privileges by sending direct HTTP requests to a Synthetic monitor endpoint. This means unauthorized users can potentially access or manipulate data they shouldn't by exploiting this flaw. [1]
How can this vulnerability impact me? :
This vulnerability can lead to privilege abuse, allowing attackers to gain unauthorized access to sensitive information (high confidentiality impact) and potentially affect the integrity and availability of the system to a lesser extent. Because the attack can be performed remotely with low complexity and no user interaction, it poses a significant security risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for direct HTTP requests to the Synthetic monitor endpoint in Kibana. You can check access logs for unusual or unauthorized requests targeting the synthetics endpoints. Specific commands depend on your environment, but for example, using curl to test access: `curl -i -X GET http://<kibana-host>/api/synthetics/monitors` to see if unauthorized access is possible. Additionally, reviewing Kibana logs and network traffic for suspicious requests to synthetics-related URLs can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Kibana to version 8.12.1 or later where the issue is fixed. If upgrading is not possible immediately, you can disable the synthetics app by setting `xpack.uptime.enabled: false` in the `kibana.yml` configuration file. Another mitigation is applying a read-only index block on the `synthetics-*` indices to prevent unauthorized access. [1]