Kibana

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Kibana asset row) │ $7,000 │ $8,000 High │ $3,000 │ $3,750 Medium │ $1,500 │ $1,875 Low │ $700 │ $875 Submit a vulnerability CVE history 51 Last 12 months 134 Lifetime XSS 35 % Access control 30 % Info disclosure 20 % Code execution 13 % Latest advisories Loading the feed Overview Kibana is the web front end and administrative console for the Elastic Stack: the interface through which Elasticsearch clusters are queried, dashboarded, configured and operated, and in practice the place a human sits when they hold cluster-administrative rights. That position is what makes its bug profile distinctive. Cross-site scripting is 35% of everything Kibana has ever had, and an XSS in an admin console is not a nuisance finding, it is a way to act on the cluster as whoever is looking at the screen. The volume is real too: 134 CVEs lifetime and 51 of them in the last twelve months alone, more recent CVE traffic than any other Elastic component covered here. Elastic N.V. pays it on HackerOne against a bound per-asset row running from $700 for a Low to $7,000 for a Critical, and those figures are minimums the program awards up from. sorona.xyz adds 1.25x on top of whatever Elastic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~11 hours First response ~6 days Triage ~43 days Bounty In scope The bounty-eligible asset is Kibana itself, up to critical severity, on the same template Elastic uses for every product: any currently supported version, the platform downloads, the official container image and the github.com/elastic/kibana source behind them Elastic names the console explicitly and puts no ceiling on which part of it counts: 'Find an XSS in Kibana? Report it... If we wrote code with a bug in it, we want to know about it! Our code is open so use that to your advantage!' The browser application in full: Discover, Dashboards, Visualize, Lens, Canvas, Maps, Dev Tools and Stack Management, plus saved objects and their import and export paths The Node.js server behind the console: the HTTP route layer and its API endpoints, the plugin platform, the saved-objects service, task manager, reporting, and alerting with its connectors Authentication and multi-tenancy: every login provider Kibana supports, session and token handling, spaces, roles and privileges, and encrypted saved objects The solution plugins that ship inside the distribution, including Observability, Elastic Security with its rules, cases and timelines, machine learning, and the Fleet and integrations management UI Everything Kibana holds or forwards server-side: its kibana.yml configuration, the credentials it uses for the Elasticsearch connection, and the queries it proxies on a user's behalf Code under x-pack/ , which is Elastic-Licensed rather than open source but is still paid on the same $7,000 row Out of scope Anything requiring administrative or root OS privileges to exploit in the first place Findings only reproducible on end-of-life or legacy versions of the distribution Volumetric denial of service, described by the policy as 'network flooding, request flooding, port flooding, required traffic volume scaling with deployment size', which is never eligible Cross-site scripting without a CSP bypass, which Elastic assesses case by case and may pay only at low severity, a caveat that bites harder here than anywhere else in the program given how much of Kibana's history is XSS Third-party components and services, which fall outside the policy even where Kibana bundles them Supply-chain findings against Elastic's build and release tooling, which are paid on the separate Software Supply Chain row rather than as a Kibana finding Assets from Elastic acquisitions closed within the last six months Application-layer findings shown only on a deployment below the 1 CPU and 2 GB RAM floor the program requires Most-valued findings Stored XSS that fires in the session of a user holding cluster-administrative rights, chaining the dominant 35% bug class into privileged action against the Elasticsearch cluster behind the console Access-control failure that lets a user of one space, role or tenant reach saved objects, data or administrative actions reserved for another, a further 30% of Kibana's history An authentication or session flaw that lets an unauthenticated request act as a logged-in operator Disclosure of the Elasticsearch credentials or configuration Kibana holds server-side, which hands over the cluster rather than just the console Server-side code execution in the Node.js layer through a templating, deserialization or rendering path, the rarest class here at 13% but the one that reaches the top of the row Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The version must be a currently supported one; Elastic's EOL list governs and legacy builds do not count The bounty-eligible asset is the shipped Kibana distribution rather than a source-code asset, so demonstrate the bug against a built and running Kibana, not against the repository alone The $9,000 figure on Elastic's table belongs to the Software Supply Chain row and not to Kibana; the Kibana row caps at $7,000 and floors at $700 Kibana is tri-licensed AGPLv3 / Elastic License 2.0 / SSPL and the open-source gate passes on the AGPL option, so x-pack/ code is paid but is not an open-source finding Application-layer findings must be reproduced on a deployment with at least 1 CPU and 2 GB of RAM, and volumetric denial of service is never eligible Program stats 891 Reports resolved $986k Bounties paid 79% Response efficiency Disclosure Coordinated through HackerOne under the platform's own disclosure guidelines. Elastic's policy carries no exclusivity, confidentiality, IP-assignment or third-party clause, so a sorona.xyz-routed report breaks nothing; we hold the finding until Elastic has fixed it and published its advisory. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability