# Kibana 8.15.1 Security Update (ESA-2024-27, ESA-2024-28)

**URL:** <https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119>\
**Category:** Security Announcements\
**Created:** [September 5, 2024, 7:19pm UTC](https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119 "2024-09-05T19:19:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Post date:** [September 5, 2024, 7:19pm UTC](https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119/1 "2024-09-05T19:19:30Z")

</div>

**Kibana arbitrary code execution via YAML deserialization in Amazon Bedrock Connector (ESA-2024-27)**

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.

This issue only affects users that use [Elastic Security’s built-in AI tools](https://www.elastic.co/guide/en/security/current/ai-for-security.html) and have configured an [Amazon Bedrock connector](https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html).

**Affected Versions:**  
Kibana version 8.15.0.

**Solutions and Mitigations:**  
Users should upgrade to version 8.15.1 or higher.

**For Users that Cannot Upgrade:**  
Customers who cannot upgrade to 8.15.1 and must stay on 8.15.0 can disable the integration assistant by setting `xpack.integration_assistant.enabled: false` in their `kibana.yml` configuration file.

**Severity:** CVSSv3.1: 9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

**CVE ID:** CVE-2024-37288

* * *

**Kibana arbitrary code execution via YAML deserialization (ESA-2024-28)**

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.

A successful attack requires a malicious user to have a combination of both specific [Elasticsearch indices privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv) and [Kibana privileges](https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html) assigned to them.

The following Elasticsearch indices permissions are required

- `write` privilege on the system indices `.kibana_ingest*`
- The `allow_restricted_indices` flag is set to `true`

Any of the following Kibana privileges are additionally required

- Under `Fleet` the `All` privilege is granted
- Under `Integration` the `Read` or `All` privilege is granted
- Access to the `fleet-setup` privilege is gained through the Fleet Server’s service account token

**Affected Versions:**  
Kibana versions 8.10.0 to 8.15.0.

**Solutions and Mitigations:**  
Users should upgrade to version 8.15.1 or higher.

**CVSS v3.1:** 9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

**CVE ID:** CVE-2024-37285