CVE-2018-17246·Kibana vulnerability

How Defensia detected this

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2018-17246 starting 2026-10-05, across 8.4% of the servers Defensia monitors, from 36 distinct attacking IP addresses.

Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.

Aggregated across every server Defensia monitors, over 16 days of observation, last measured 2026-10-23. Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.

Affected versions

How to fix this CVE

Upgrade Kibana to version 6.4.3 or later immediately to patch the arbitrary code execution vulnerability in the Console plugin. Organizations running versions 6.0.0 through 6.4.2 should prioritize this update as the flaw allows remote attackers to execute arbitrary JavaScript within the Kibana process context. Verify the upgrade was successful by checking the Kibana version endpoint and restarting the service.

sudo dnf install -y kibana-6.4.3

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /api/console/api_server HTTP/1.1.*Content-Type: application/json.*(?:exec|eval|require|process\.)|GET /api/console/proxy.*['"].*(?:process|child_process|fs|os)['"]

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or restrict unauthenticated access to /api/console/* endpoints. Implement IP whitelisting for the Console API and require authentication headers (Authorization: Bearer token). Log all POST requests to /api/console/api_server with full request bodies for forensic analysis.

How to check if you are affected

1. Step 1: Check installed Kibana version by running: curl -s http://localhost:5601/api/status | jq '.version.number' or grep -oP '(?<="number":")\d+\.\d+\.\d+' /var/log/kibana/kibana.log
2. Step 2: Verify Console plugin is enabled by checking the Kibana configuration: grep -i 'console' /etc/kibana/kibana.yml
3. Step 3: Search application logs for suspicious Console API requests: grep -E 'POST|GET.*console.*api' /var/log/kibana/kibana.log | grep -v '200\|304'
4. Step 4: Confirm the patch by verifying the version is 6.4.3 or higher: curl -s http://localhost:5601/api/status | jq '.version.number'

FAQ

References

• http://www.securityfocus.com/bid/106285
• https://access.redhat.com/errata/RHBA-2018:3743
• https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
• https://www.elastic.co/community/security
• http://www.securityfocus.com/bid/106285