CVE-2025-25018: Elastic Kibana Stored XSS Vulnerability

CVE-2025-25018 Overview

CVE-2025-25018 is a stored Cross-Site Scripting (XSS) vulnerability in Elastic Kibana. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that persists in Kibana. When another user loads the affected page, the browser executes the injected payload in that user's session context.

The vulnerability affects confidentiality and integrity at a limited scope and requires user interaction to trigger. Successful exploitation can allow session data theft, UI manipulation, and actions performed on behalf of the victim within Kibana.

Critical Impact
Authenticated attackers can persist malicious JavaScript in Kibana that executes in other users' browsers, enabling session abuse and content manipulation across the shared Kibana interface.

Affected Products

Elastic Kibana versions prior to 8.18.8
Elastic Kibana versions prior to 8.19.5
Elastic Kibana versions prior to 9.0.8 and 9.1.5

Discovery Timeline

2025-10-10 - CVE-2025-25018 published to the National Vulnerability Database
2026-10-08 - Last updated in the NVD database

Technical Details for CVE-2025-25018

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the Kibana web interface. Kibana fails to properly neutralize certain user-supplied input before rendering it in generated web pages. The unsanitized content is persisted server-side and later served to other users of the same Kibana instance.

When a victim views an affected view, the browser parses the attacker-controlled markup and executes the embedded script. The script runs in the origin of the Kibana application and inherits the victim's session cookies and permissions. The attack vector is network-based and requires both prior authentication by the attacker and user interaction by the victim.

The scope is marked as changed because script execution in the victim's browser affects a security authority different from the vulnerable component. Impact to confidentiality and integrity is limited; the issue does not directly degrade availability.

Root Cause

The root cause is missing or insufficient output encoding when Kibana renders fields that accept user-controlled input. HTML-significant characters are not consistently escaped before being written to the DOM, allowing script tags or event handlers to be interpreted by the browser.

Attack Vector

An authenticated low-privileged user submits a crafted payload through a Kibana input surface that stores content for later display. A second user with access to the same object loads the page, and the browser executes the stored JavaScript. The attacker can then exfiltrate session tokens, invoke Kibana APIs, or alter rendered content for the victim.

No verified public proof-of-concept is available at this time. Refer to the Elastic security update discussion for vendor-provided technical context.

Detection Methods for CVE-2025-25018

Indicators of Compromise

Stored Kibana objects containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs in fields that normally hold plain text.
Outbound HTTP requests from analyst browsers to unexpected domains immediately after loading a Kibana dashboard or saved object.
Kibana audit log entries showing object creation or updates by low-privileged accounts shortly before anomalous session activity.

Detection Strategies

Enable Kibana audit logging and review saved_objects create and update events for payloads containing HTML or script syntax.
Deploy a Content Security Policy (CSP) report-only endpoint and alert on violations originating from the Kibana origin.
Inspect reverse proxy or WAF logs for POST requests to Kibana API endpoints carrying script-like payloads in body parameters.

Monitoring Recommendations

Monitor Kibana user sessions for unexpected API calls that follow a dashboard load, especially privileged administrative actions by non-admin users.
Track anomalous changes to shared dashboards, visualizations, and saved searches made by accounts without a change-management ticket.
Correlate browser telemetry from analyst workstations with Kibana server access logs to identify script execution tied to specific stored objects.

How to Mitigate CVE-2025-25018

Immediate Actions Required

Upgrade Kibana to a fixed release: 8.18.8, 8.19.5, 9.0.8, or 9.1.5 as applicable to your deployment branch.
Audit existing saved objects, dashboards, and visualizations for stored HTML or script content and remove suspicious entries.
Rotate Kibana session cookies and API keys for users who may have viewed attacker-controlled content prior to patching.

Patch Information

Elastic has released fixed versions in the 8.18.8, 8.19.5, 9.0.8, and 9.1.5 branches. Refer to the Elastic security update ESA-2025-17 discussion for complete upgrade guidance.

Workarounds

Restrict Kibana write permissions so that only trusted users can create or modify saved objects, dashboards, and visualizations.
Place Kibana behind a reverse proxy that enforces a strict Content Security Policy limiting inline script execution and external script sources.
Isolate Kibana access to a dedicated browser profile or workstation to limit the blast radius of a successful XSS payload.

bash

# Example reverse proxy header enforcing a restrictive CSP for Kibana
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;