CVE-2025-37732: Elastic Kibana XSS Vulnerability

CVE-2025-37732 Overview

CVE-2025-37732 is a stored Cross-Site Scripting (XSS) vulnerability in Elastic Kibana. The flaw resides in the integration package upload functionality. An authenticated user can inject HTML tags that render inside another user's browser session. The issue represents a bypass of the previous fix released for ESA-2025-17 (CVE-2025-25018).

The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Elastic addressed the issue in Kibana 8.19.8, 9.1.8, and 9.2.2 through security advisory ESA-2025-28.

Critical Impact
An authenticated attacker can execute HTML injection against other Kibana users, enabling phishing, session data exposure, or client-side redirection through the integration package upload workflow.

Affected Products

Elastic Kibana versions prior to 8.19.8
Elastic Kibana 9.x versions prior to 9.1.8
Elastic Kibana 9.2.x versions prior to 9.2.2

Discovery Timeline

2025-12-15 - CVE-2025-37732 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37732

Vulnerability Analysis

The vulnerability originates in Kibana's integration package upload feature. Kibana fails to properly neutralize user-supplied input before rendering it inside the web application. An authenticated user with permissions to upload integration packages can embed HTML markup that Kibana serves back to any user viewing the affected page.

This flaw is a regression bypass of the fix released for CVE-2025-25018 under advisory ESA-2025-17. The prior patch did not account for all injection paths through the integration package upload functionality. Attackers can craft new payloads that evade the earlier sanitization logic.

Exploitation requires user interaction and authenticated access. The impact scope crosses trust boundaries because injected content executes in the browser context of any Kibana user who views the malicious integration package.

Root Cause

The root cause is missing or insufficient output encoding when Kibana renders integration package metadata in the browser. The prior sanitization applied under ESA-2025-17 did not cover the specific HTML tag rendering path exposed by the upload functionality. Content submitted through the package upload interface reaches the DOM without complete neutralization.

Attack Vector

An authenticated attacker uploads a crafted integration package containing HTML payload elements. When a legitimate user opens or previews the malicious package inside Kibana, the browser parses and renders the injected markup. This can be leveraged for credential harvesting through fake login prompts, defacement, or forced navigation to attacker-controlled infrastructure.

Refer to the Elastic Security Update ESA-2025-28 for the vendor's technical description of the injection path.

Detection Methods for CVE-2025-37732

Indicators of Compromise

Integration package uploads containing HTML tags, <script>, <img>, <iframe>, or event handler attributes such as onerror and onload in package metadata fields
Kibana audit log entries showing integration package uploads from non-administrative or unexpected user accounts
Anomalous outbound requests from user browsers correlated with viewing integration package details

Detection Strategies

Inspect Kibana audit logs for PUT or POST requests to integration package management endpoints from low-privilege users
Scan stored integration package definitions for HTML tags or JavaScript event handlers in name, description, and README fields
Correlate authentication events with integration package modification actions to identify suspicious patterns

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized log platform for retention and analysis
Alert on integration package uploads followed by mass user access to those packages within short time windows
Monitor browser Content Security Policy (CSP) violation reports from Kibana users to detect injection attempts

How to Mitigate CVE-2025-37732

Immediate Actions Required

Upgrade Kibana to version 8.19.8, 9.1.8, or 9.2.2 as documented in advisory ESA-2025-28
Audit existing integration packages for suspicious HTML content and remove any that contain unexpected markup
Review the list of users with permissions to upload integration packages and restrict access to trusted administrators

Patch Information

Elastic released fixed versions of Kibana on the ESA-2025-28 advisory page. Upgrade to Kibana 8.19.8 for the 8.x branch, 9.1.8 for the 9.1.x branch, or 9.2.2 for the 9.2.x branch. Consult the Elastic Security Update ESA-2025-28 advisory for full remediation guidance.

Workarounds

Restrict integration package upload privileges to a small set of trusted administrators through Kibana role-based access control
Enforce a strict Content Security Policy in Kibana deployments to reduce the impact of injected HTML and inline scripts
Require secondary review of integration packages before they are made available to broader user populations

bash

# Configuration example: restrict integration package management via Kibana role
# Assign the built-in role only to trusted administrators
POST /_security/role/kibana_integration_admin
{
  "kibana": [
    {
      "base": [],
      "feature": {
        "fleet": ["all"],
        "fleetv2": ["all"]
      },
      "spaces": ["*"]
    }
  ]
}