A critical security vulnerability has been discovered in Kibana, a popular data visualization platform for Elasticsearch. This vulnerability, tracked as CVE-2025-25012, stems from a prototype pollution issue. It could allow hackers to execute malicious code on affected systems, posing a significant risk to organizations using Kibana for data analysis and monitoring.

Vulnerability Details

• Vulnerability ID: CVE-2025-25012

• Severity Level: Critical

• CVSSv3 Score: 9.9

• General Description: The Prototype Pollution vulnerability in Kibana can lead to arbitrary code execution through malicious file uploads and specially crafted HTTP requests.

• Affected Versions:

  • In versions Kibana >=8.15.0 to <8.17.1, this vulnerability can be exploited by users with the Viewer role.

  • In versions Kibana 8.17.1 and 8.17.2, only users with roles containing all the following permissions can exploit this vulnerability:

    • fleet-all

    • integrations-all

    • actions:execute-advanced-connectors

Impact

Kibana is a crucial tool for many organizations, especially in the fields of real-time information monitoring, security analysis, and business intelligence (BI). Therefore, this vulnerability becomes a prime target for hackers, as it can be exploited to execute malicious code on the system.

The threat from this vulnerability becomes more severe when low-privilege accounts can also be exploited as an initial entry point. This means that even users with only data viewing permissions in Kibana can inadvertently become a backdoor for hackers. If the system is compromised, consequences may include data leaks, system control takeover, or complete operational disruption. This not only directly affects businesses but also paves the way for subsequent attacks.

Recommendations

FPT Threat Intelligence recommends organizations and individuals take several measures to prevent this vulnerability:

• System Update: Quickly upgrade Kibana to the latest version to address the security vulnerability.

• Access Management: Review and restrict user access, granting permissions only when necessary.

• Activity Monitoring: Monitor network traffic and system logs to detect early signs of vulnerability exploitation.

• Security Awareness: Train employees about the risks from the vulnerability and potential attack methods.

• Enhanced Defense: Implement protective measures such as firewalls, IDS/IPS, and conduct regular security checks.

References

• Critical Kibana Vulnerability (CVE-2025-25012) Exposes Systems to Code Execution, Patch Now

• CVE-2025-25015 Detail