Introduction
Attackers can exploit a single malicious dashboard to compromise user sessions and gain unauthorized access to sensitive data in Kibana deployments. The recent discovery of CVE-2025-25017 highlights a critical cross-site scripting (XSS) flaw in the Vega visualization engine, impacting a vast range of Kibana versions and exposing organizations to significant risk if left unpatched.
About Kibana and Elastic: Kibana is the visualization and dashboard component of the Elastic Stack, which also includes Elasticsearch, Logstash, and Beats. Elastic is a major force in the observability and analytics space, with its products used by thousands of enterprises for log management, security analytics, and business intelligence. Kibana's Vega integration enables advanced, flexible visualizations, making it a popular choice for technical teams worldwide.
Technical Information
CVE-2025-25017 is a vulnerability in Kibana's Vega visualization engine that results from improper neutralization of user-supplied input during web page generation. Vega specifications are JSON-based documents that define how data should be visualized, including data sources, transformations, and interactive behaviors. In affected versions of Kibana (7.0.0 through 9.1.3), certain fields within the Vega spec were not properly sanitized before being rendered in the browser. This allowed attackers with permissions to create or modify Vega visualizations to inject malicious JavaScript payloads directly into the visualization definition.
When a victim user views a dashboard or visualization containing the malicious Vega spec, the injected script executes in the context of their browser session. This enables a range of attacks, including session hijacking, credential theft, and unauthorized actions performed via the Kibana API. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and the attack complexity is low, requiring only that a victim view a crafted visualization. No public proof of concept has been released as of this writing.
Patch Information
To address the security vulnerabilities identified in Kibana, the development team has released updates in versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5. These updates specifically target and remediate the following issues:
-
Cross-Site Scripting (XSS) in Vega Visualizations: The vulnerability allowed improper neutralization of input during web page generation in Vega visualizations, potentially leading to XSS attacks. The patch ensures that all user inputs are properly sanitized before rendering, thereby preventing malicious scripts from executing within the Kibana interface. (discuss.elastic.co)
-
Stored Cross-Site Scripting (XSS) via Case File Upload: This issue permitted the storage of malicious scripts through case file uploads, which could be executed when the case was viewed. The fix involves enhanced validation and sanitization of file contents upon upload, ensuring that any embedded scripts are neutralized and cannot be executed. (discuss.elastic.co)
-
Stored Cross-Site Scripting (XSS) in Fleet and Integrations: A flaw in the validation of input types within the Fleet and Integrations modules could lead to stored XSS attacks. The update introduces stricter input validation mechanisms, ensuring that only expected data types are processed and any potentially harmful inputs are rejected. (discuss.elastic.co)
-
Insufficiently Protected Credentials in the CrowdStrike Connector: The vulnerability exposed cached credentials from the Elastic CrowdStrike connector, allowing unauthorized access across different spaces. The patch enhances the security of credential storage and access controls, ensuring that credentials are compartmentalized and accessible only within their intended scope. (discuss.elastic.co)
Users are strongly encouraged to upgrade to the patched versions to mitigate these vulnerabilities. For those unable to upgrade immediately, disabling the affected features, such as Vega visualizations, can serve as a temporary mitigation measure. However, upgrading remains the most effective solution to ensure the security and integrity of your Kibana deployment.
Affected Systems and Versions
CVE-2025-25017 affects the following Kibana versions:
- 7.x: All versions from 7.0.0 up to and including 7.17.29
- 8.x: All versions from 8.0.0 up to and including 8.18.7
- 8.19.x: All versions from 8.19.0 up to and including 8.19.3
- 9.0.x: All versions from 9.0.0 up to and including 9.0.6
- 9.1.x: All versions from 9.1.0 up to and including 9.1.3
All configurations with Vega visualizations enabled are vulnerable.
Vendor Security History
Elastic has previously addressed multiple XSS vulnerabilities in Kibana and related Elastic Stack components. Their security advisories are detailed and timely, and the company maintains a responsible disclosure program. Patch response times for critical issues have historically been prompt, with fixes released across all supported version lines. Elastic's security maturity is reflected in their transparent communication and comprehensive patching approach.
