5601-pentesting-kibana.md (4953B)
1 --- 2 title: "5601/tcp - Pentesting Kibana" 3 section: "Network Services" 4 sectionSlug: "network-services-pentesting" 5 sourcePath: "src/network-services-pentesting/5601-pentesting-kibana.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/5601-pentesting-kibana.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # 5601/tcp - Pentesting Kibana 14 15 ## Basic Information 16 17 Kibana is the Elastic Stack web interface for searching, visualizing, and administering Elasticsearch data. A self-managed installation listens on `localhost:5601` by default, although both the bind address and port are configurable in `kibana.yml`.<sup>[[1]](#references)</sup> 18 19 ## Initial checks 20 21 - Open `/status` or use the status API to identify the deployed version and service health.<sup>[[2]](#references)</sup> 22 - Determine whether the instance exposes a login form, anonymous access, or a configured SSO provider. Kibana supports multiple authentication providers backed by Elasticsearch security.<sup>[[3]](#references)</sup> 23 - On legacy or deliberately unsecured stacks where Elasticsearch security is disabled and no reverse proxy supplies authentication, Kibana may be reachable without credentials. When security is enabled, interactive users authenticate through Kibana's configured provider and their effective access is determined by the associated Elasticsearch roles plus Kibana feature and space privileges; it is not safe to assume that every Elasticsearch credential has identical UI access.<sup>[[3]](#references)</sup> 24 - If local file access is already available, inspect `/etc/kibana/kibana.yml` on package installations, or `$KIBANA_HOME/config/kibana.yml` on archive installations. Do not assume Elasticsearch credentials are stored there: modern deployments can use service-account tokens or a keystore.<sup>[[1]](#references)</sup> 25 - On older password-based deployments, `kibana.yml` may contain the credentials Kibana uses to connect to Elasticsearch. The expected built-in identity is `kibana_system`, which is a service account rather than an interactive Kibana user. Credentials for a broader identity—especially `elastic` or another superuser—are substantially more sensitive and indicate excessive privilege.<sup>[[5]](#references)</sup> 26 - Record whether browser-to-Kibana and Kibana-to-Elasticsearch connections use TLS. 27 28 ## Actions after authorized access 29 30 The available features depend on the authenticated user's Elasticsearch and Kibana privileges. Within the scope of the assessment:<sup>[[3]](#references)</sup> 31 32 - Review accessible data views, dashboards, saved searches, and developer-console access for sensitive data. 33 - Inspect Stack Management for exposed users, roles, API keys, connectors, and saved objects. Where the account has the required privileges, these interfaces can create, edit, or delete users and roles and create or invalidate API keys; do not make those changes unless the test explicitly permits it.<sup>[[3]](#references)</sup> 34 - Compare the exact Kibana and Elasticsearch versions with Elastic security advisories. Avoid inferring vulnerability from the major version alone. 35 - As a historical example, Kibana versions before 5.6.15 and 6.6.1 had an arbitrary-code-execution vulnerability in Timelion (CVE-2019-7609). Access to Timelion was a prerequisite, and Elastic's remediation was to upgrade or disable Timelion.<sup>[[4]](#references)</sup> 36 - Check whether low-privileged accounts can reach administrative features or data outside their intended spaces. 37 38 For a worked assessment covering discovery, credential sources, index access, and historical exploitation paths across the ELK stack, see the practical guide in reference 6.<sup>[[6]](#references)</sup> 39 40 ## Transport-security considerations 41 42 If Kibana is reachable over plaintext HTTP, credentials, session cookies, queries, and returned data may be exposed to an on-path observer. Also verify certificate validation on Kibana's connection to Elasticsearch.<sup>[[1]](#references)</sup> 43 44 ## References 45 46 - [1] [Elastic documentation - Configure Kibana](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/configure-kibana) 47 - [2] [Elastic documentation - Check Kibana server status](https://www.elastic.co/docs/troubleshoot/kibana/access) 48 - [3] [Elastic documentation - Authentication in Kibana](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication) 49 - [4] [Elastic security announcement - Kibana Timelion Remote Code Execution (ESA-2019-02)](https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077) 50 - [5] [Elastic documentation - Built-in users](https://www.elastic.co/guide/en/elasticsearch/reference/8.19/built-in-users.html) 51 - [6] [ERNW - Pentesting the ELK Stack](https://insinuator.net/2021/01/pentesting-the-elk-stack/)