Elastic Kibana Node.js Security Vulnerabilities (ESA-2021-24)

[Orhan YILDIRIM]

Hello Guys,

I did a security scan and found the following results. 

But how can I close this vulnerability? is there a way

Thanks,

Orhan

Installed version: 7.10.2
Fixed version:     7.14.1

Insight
Node.js version 14.17.3 is affected by several security

vulnerabilities: CVE-2021-22940, CVE-2021-3672, CVE-2021-22931, and CVE-2021-22939. We do not
believe an attacker can exploit these against Kibana, but we are upgrading Node.js out of an
abundance of caution. Kibana 7.14.1 upgrades Node.js to version 14.17.5 to resolve these issues.
Detection Method
Checks if a vulnerable version is present on the target host.
Details:
Elastic Kibana Node.js Security Vulnerabilities (ESA-2021-24) OID: 1.3.6.1.4.1.25623.1.0.117776

Version used:
2021-12-16T03:03:23Z
Affected Software/OS
Elastic Kibana version 7.14.0 and prior.

Solution
Solution Type:
Vendorfix
Update to version 7.14.1 or later.

[Chema Martinez]

Hi Orhan,

Thank you for posting in the Wazuh community.

I don't fully understand if you want to fix the vulnerabilities in your Node.js version or just silence the vulnerability alerts being aware that your version is vulnerable.

Could you please tell us the Wazuh version you are using and the alerts from the Vulnerability scanner related to these CVEs? That way we can know more precisely how the scanner has detected the vulnerabilities. It could be also helpful to know in which OS is the vulnerable Kibana installed.

Thanks in advance!

[Chema Martinez]

Hi again Orhan,

Thanks for your response, I received your vulnerability report in my inbox. Please, for the next messages let's use this thread if you don't have to share sensitive information.

Regarding the report, it seems the only way to prevent these vulnerabilities is by upgrading your Kibana to 7.14.1 or newer.

It would be interesting to know if the Wazuh's vulnerability scanner is also reporting the vulnerabilities. Could you please enable it in the ossec.conf file in the manager?

 <vulnerability-detector>

<enabled>yes</enabled> <interval>5m</interval> <ignore_time>6h</ignore_time> <run_on_start>yes</run_on_start> <!-- Ubuntu OS vulnerabilities --> <provider name="canonical"> <enabled>yes</enabled> <os>focal</os> <update_interval>1h</update_interval> </provider> <!-- Aggregate vulnerabilities --> <provider name="nvd"> <enabled>yes</enabled> <update_from_year>2010</update_from_year> <update_interval>1h</update_interval> </provider> </vulnerability-detector>

Applying that configuration will only scan for Ubuntu 20.04 agents as yours.

Regards,

Chema.

[Orhan YILDIRIM]

Hi  Chema,

Thank you very much for this valuable information. I will try this

 

"Regarding the report, it seems the only way to prevent these vulnerabilities is by upgrading your Kibana to 7.14.1 or newer."

https://github.com/wazuh/wazuh-kibana-app I tried from here and got the following error. Is there a way to update Kibana?  

 

sudo -u kibana bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.5_7.14.2-1.zip
Attempting to transfer from https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.5_7.14.2-1.zip
Transferring 32476495 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation was unsuccessful due to error "Plugin wazuh [7.14.2] is incompatible with Kibana [7.10.2]"

Thank you,

Orhan

4 Mart 2022 Cuma tarihinde saat 14:33:51 UTC+3 itibarıyla chema.m...@wazuh.com şunları yazdı:

[Chema Martinez]

Hi Orhan,

It seems you are trying to install directly the Wazuh plugin for Kibana 7.14.2 under your Kibana version which is still 7.10.2.

To avoid the vulnerabilities you have to upgrade your whole Elastic stack from 7.10.2 to a newer version, which includes upgrading Kibana of course.

After that, you will be able to upgrade the Wazuh plugin. Please, check the following table with the compatibility matrix for the Wazuh App:

https://github.com/wazuh/wazuh-kibana-app/tree/v4.2.5-7.10.2#wazuh---kibana---open-distro-version-compatibility-matrix

You can also check how to upgrade the ELK in:

https://documentation.wazuh.com/current/upgrade-guide/elasticsearch-kibana-filebeat/index.html

I hope it helps!

Best regards,

Chema.

[Orhan YILDIRIM]

Thank you Chema,  I'm examining.

Regards,

Orhan

4 Mart 2022 Cuma tarihinde saat 15:08:38 UTC+3 itibarıyla chema.m...@wazuh.com şunları yazdı: