{"id":1567887,"date":"2025-03-06T12:16:28","date_gmt":"2025-03-06T14:16:28","guid":{"rendered":"https:\/\/teknomers.com\/fr\/reliminaires-elastiques-correction-urgente-pour-la-vulnerabilite-critique-du-kibana-permettant-lexecution-du-code-distant\/"},"modified":"2025-03-06T12:16:33","modified_gmt":"2025-03-06T14:16:33","slug":"reliminaires-elastiques-correction-urgente-pour-la-vulnerabilite-critique-du-kibana-permettant-lexecution-du-code-distant","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/reliminaires-elastiques-correction-urgente-pour-la-vulnerabilite-critique-du-kibana-permettant-lexecution-du-code-distant\/","title":{"rendered":"Reliminaires \u00e9lastiques Correction urgente pour la vuln\u00e9rabilit\u00e9 critique du kibana permettant l&#8217;ex\u00e9cution du code distant"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">06 mars 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">S\u00e9curit\u00e9 des donn\u00e9es \/ s\u00e9curit\u00e9 des logiciels<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/03\/Reliminaires-elastiques-Correction-urgente-pour-la-vulnerabilite-critique-du-kibana.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p><b>\u00c9lastique <\/b>a d\u00e9ploy\u00e9 des mises \u00e0 jour de s\u00e9curit\u00e9 pour aborder une faille de s\u00e9curit\u00e9 critique <b>Kibana <\/b>logiciel de tableau de bord de visualisation des donn\u00e9es pour <b>Elasticsearch <\/b>Cela pourrait entra\u00eener une ex\u00e9cution arbitraire de code.<\/p>\n<p>La vuln\u00e9rabilit\u00e9, suivie comme <strong>CVE-2025-25012<\/strong>porte un score CVSS de 9,9 sur un maximum de 10,0. Il a \u00e9t\u00e9 d\u00e9crit comme un cas de pollution prototype.<\/p>\n<p>&#8220;La pollution du prototype \u00e0 Kibana conduit \u00e0 une ex\u00e9cution de code arbitraire via un t\u00e9l\u00e9chargement de fichiers fabriqu\u00e9 et des demandes HTTP sp\u00e9cifiquement con\u00e7ues&#8221;, la soci\u00e9t\u00e9 <a rel=\"noopener nofollow\" href=\"https:\/\/discuss.elastic.co\/t\/kibana-8-17-3-security-update-esa-2025-06\/375441\" target=\"_blank\">dit<\/a> Dans un avis publi\u00e9 mercredi.<\/p>\n<p><a rel=\"noopener nofollow\" href=\"https:\/\/learn.snyk.io\/lesson\/prototype-pollution\/\" target=\"_blank\">Vuln\u00e9rabilit\u00e9 de la pollution prototype<\/a> est un <a rel=\"noopener nofollow\" href=\"https:\/\/www.imperva.com\/learn\/application-security\/prototype-pollution\/\" target=\"_blank\">d\u00e9faut de s\u00e9curit\u00e9<\/a> Cela permet aux attaquants de manipuler les objets et les propri\u00e9t\u00e9s JavaScript d&#8217;une application, conduisant potentiellement \u00e0 un acc\u00e8s aux donn\u00e9es non autoris\u00e9, \u00e0 l&#8217;escalade de privil\u00e8ge, \u00e0 un d\u00e9ni de service ou \u00e0 l&#8217;ex\u00e9cution du code distant. <\/p>\n<p>La vuln\u00e9rabilit\u00e9 affecte toutes les versions de Kibana entre 8.15.0 et 8.17.3. Il a \u00e9t\u00e9 abord\u00e9 dans la version 8.17.3.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a rel=\"nofollow noopener sponsored\" href=\"https:\/\/thehackernews.uk\/cis-securesuite\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybers\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/03\/1740818990_705_Mozilla-met-a-jour-les-termes-de-Firefox-apres-le.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>Cela dit, dans les versions Kibana de 8.15.0 et avant 8.17.1, la vuln\u00e9rabilit\u00e9 n&#8217;est exploitable que par les utilisateurs avec le r\u00f4le du spectateur. Dans les versions Kibana 8.17.1 et 8.17.2, il ne peut \u00eatre exploit\u00e9 que par des utilisateurs qui ont tous les privil\u00e8ges mentionn\u00e9s ci-dessous &#8211;<\/p>\n<ul>\n<li>flotte<\/li>\n<li>int\u00e9grations-tout<\/li>\n<li>Actions: ex\u00e9cuteur-r\u00e9mun\u00e9r\u00e9<\/li>\n<\/ul>\n<p>Il est conseill\u00e9 aux utilisateurs de prendre des mesures pour appliquer les derniers correctifs pour sauvegarder contre les menaces potentielles. Dans le cas o\u00f9 le correctif imm\u00e9diat n&#8217;est pas une option, les utilisateurs sont recommand\u00e9s pour d\u00e9finir l&#8217;indicateur de fonctionnalit\u00e9 d&#8217;assistant d&#8217;int\u00e9gration sur false (&#8220;xpack.integration_assistant.enabled: false&#8221;) dans <a rel=\"noopener nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/settings.html\" target=\"_blank\">Configuration de Kibana<\/a> (&#8220;kibana.yml&#8221;).<\/p>\n<p>En ao\u00fbt 2024, Elastic a abord\u00e9 un autre d\u00e9faut de pollution du prototype critique en kibana (<a rel=\"noopener nofollow\" href=\"https:\/\/discuss.elastic.co\/t\/kibana-8-14-2-7-17-23-security-update-esa-2024-22\/364424\" target=\"_blank\">CVE-2024-37287<\/a>Score CVSS: 9.9) qui pourrait conduire \u00e0 l&#8217;ex\u00e9cution du code. Un mois plus tard, il a r\u00e9solu <a rel=\"noopener nofollow\" href=\"https:\/\/discuss.elastic.co\/t\/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28\/366119\" target=\"_blank\">Deux bogues de d\u00e9s\u00e9rialisation s\u00e9v\u00e8res<\/a> (CVE-2024-37288, score CVSS: 9.9 et CVE-2024-37285, score CVSS: 9.1) qui pourrait \u00e9galement permettre l&#8217;ex\u00e9cution de code arbitraire.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant? Suivez-nous <a rel=\"noopener nofollow\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Gazouillement <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"noopener nofollow\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">Liendin<\/a> Pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/elastic-releases-urgent-fix-for.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80206 mars 2025\ue804Ravie LakshmananS\u00e9curit\u00e9 des donn\u00e9es \/ s\u00e9curit\u00e9 des logiciels \u00c9lastique a d\u00e9ploy\u00e9 des mises \u00e0 jour de s\u00e9curit\u00e9 pour aborder une faille de s\u00e9curit\u00e9 critique Kibana logiciel de tableau de bord de visualisation des donn\u00e9es pour Elasticsearch Cela pourrait entra\u00eener une ex\u00e9cution arbitraire de code. La vuln\u00e9rabilit\u00e9, suivie comme CVE-2025-25012porte un score CVSS de [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1567888,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[274266,274265,5597,4168,29836,22,79002,274264,4161,274263,6124,80936,148663,284789,40144,274267,4160,106717,185,284788,238617,246491,4172,79016,13592,4166,3667,4164],"class_list":["post-1567887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-actualites-de-piratage","tag-actualites-des-pirates","tag-code","tag-comment-pirater","tag-correction","tag-critique","tag-cyber-security-news","tag-cyber-security-news-aujourdhui","tag-cyber-mises-a-jour","tag-cyber-nouvelles","tag-cyberattaques","tag-distant","tag-elastiques","tag-kibana","tag-lexecution","tag-malware-ransomware","tag-mises-a-jour-de-la-cybersecurite","tag-permettant","tag-pour","tag-reliminaires","tag-securite-de-linformation","tag-securite-du-reseau","tag-securite-informatique","tag-the-hacker-news","tag-urgente","tag-violation-de-donnees","tag-vulnerabilite","tag-vulnerabilite-logicielle"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1567887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=1567887"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1567887\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/1567888"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=1567887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=1567887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=1567887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}