Описание
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
A flaw was found in Kibana. This vulnerability allows an authenticated attacker, with privileges to create or modify connectors, to disclose arbitrary files. The attacker achieves this by submitting a specially crafted configuration for the Google Gemini connector, which the server processes without proper validation, enabling arbitrary network requests and file reads.
Отчет
This vulnerability is rated Important for Red Hat products as it allows an authenticated attacker with privileges to create or modify connectors in Kibana to disclose arbitrary files. Exploitation requires a specially crafted configuration for the Google Gemini connector. Red Hat products like Enterprise Application Platform, OpenShift Container Platform, Red Hat OpenStack Platform, and Red Hat OpenShift distributed tracing that include Kibana are affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/elasticsearch-rhel9-operator | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/kibana6-rhel8 | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | kibana | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | kibana | Not affected | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-jaeger-query-rhel8 | Affected | ||
| Red Hat OpenStack Platform 16.2 | puppet-kibana3 | Not affected |
Показывать по
Дополнительная информация
Статус:
8.6 High
CVSS3
Связанные уязвимости
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
External Control of File Name or Path (CWE-73) combined with Server-Si ...
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
8.6 High
CVSS3