# Workaround for Kibana Reporting Vulnerability ESA-2018-17 (CVE-2018-17245)
**URL:** https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [November 9, 2018, 3:36pm UTC](https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078 "2018-11-09T15:36:07Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ypid-geberit](https://discuss.elastic.co/u/ypid-geberit)
#### Post date: [November 9, 2018, 3:36pm UTC](https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078/1 "2018-11-09T15:36:07Z")
I would like to propose a workaround to mitigate CVE-2018-17245 which:
- Does not require a Kibana (and in turn also Elasticsearch) upgrade.
- Does not require to disable reporting altogether using `xpack.reporting.enabled`.
It works by blocking outgoing connections from the Kibana user to the Internet on the server where Kibana is running. Example iptables script:
```auto
iptables -F OUTPUT
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT ! -d 10.0.0.0/8 -m owner --uid-owner kibana -m limit --limit 5/min -j LOG --log-prefix "Kibana security workaround: " --log-level 7
iptables -A OUTPUT ! -d 10.0.0.0/8 -m owner --uid-owner kibana -j REJECT
ip6tables -F OUTPUT
ip6tables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT ! -d fd95:9d43:c67b:3d75::/64 -m owner --uid-owner kibana -m limit --limit 5/min -j LOG --log-prefix "Kibana security workaround: " --log-level 7
ip6tables -A OUTPUT ! -d fd95:9d43:c67b:3d75::/64 -m owner --uid-owner kibana -j REJECT
```
Feel free to give feedback on this.
Ref: [https://www.elastic.co/blog/elastic-support-alert-kibana-reporting-vulnerability](https://www.elastic.co/blog/elastic-support-alert-kibana-reporting-vulnerability)
Ref: [https://github.com/elastic/kibana/pull/24177](https://github.com/elastic/kibana/pull/24177)
---
### Author:  [@jen-huang](https://discuss.elastic.co/u/jen-huang)
#### Post date: [November 9, 2018, 8:46pm UTC](https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078/2 "2018-11-09T20:46:42Z")
Hi Robin, thank you for suggesting this workaround. Can you open this as a Github issue, perhaps with `[Discuss]` in the title, so our security team can take a look and provide feedback?
---
### Author:  [@ypid-geberit](https://discuss.elastic.co/u/ypid-geberit)
#### Post date: [November 13, 2018, 12:54pm UTC](https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078/3 "2018-11-13T12:54:25Z")
Thanks! Done: [https://github.com/elastic/kibana/issues/25579](https://github.com/elastic/kibana/issues/25579)
I improved the example by ensuring that IPv6 is also covered.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2018, 12:54pm UTC](https://discuss.elastic.co/t/workaround-for-kibana-reporting-vulnerability-esa-2018-17-cve-2018-17245/156078/4 "2018-12-11T12:54:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.