Multiple vulnerabilities in Splunk Enterprise

1) Path traversal

EUVDB-ID: #VU98541

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45731

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to input validation error when processing filenames. A remote user can write a .dll file to the Windows system root directory, which has a default location in the Windows System32 folder, and execute it with elevated privileges.

Note, the vulnerability affects Splunk Enterprise for Windows when installed on a separate drive.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.4 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1001
http://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing Authorization

EUVDB-ID: #VU98539

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45732

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to missing authorization checks. A remote user can run a search as the “nobody” Splunk user in the SplunkDeploymentServerConfig app and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.2.0 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1002
http://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Deserialization of Untrusted Data

EUVDB-ID: #VU98538

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45733

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure session storage configuration. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Note, the vulnerability affects Splunk Enterprise for Windows.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.2.2

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1003
http://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU98537

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45734

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.2.2

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1004
http://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU98536

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45735

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and view the App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.2.2

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1005
http://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU98535

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45736

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can initiate a search query with an improperly-formatted “INGEST_EVAL” parameter as part of a Field Transformation and crash the Splunk daemon (splunkd).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.4 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1006
http://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Cross-site request forgery

EUVDB-ID: #VU98534

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45737

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website and change the maintenance mode state of App Key Value Store (KVStore).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.4 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1007
http://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Information disclosure

EUVDB-ID: #VU98533

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45738

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to software exposes sensitive HTTP parameters to the _internal index when the REST_Calls log channel is configured at the DEBUG logging level. A remote privileged user can gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1008
http://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU98531

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45739

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to application exposes plaintext passwords for local native authentication Splunk users when the Splunk Enterprise AdminManager log channel is configured at the DEBUG logging level. A remote privileged user can gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.3.0

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1009
http://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Stored cross-site scripting

EUVDB-ID: #VU98530

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45740

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject a malicious payload through Scheduled Views and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.2.2

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1010
http://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Stored cross-site scripting

EUVDB-ID: #VU98529

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45741

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can create a malicious payload through a custom configuration file and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Splunk Enterprise: 9.0.0 - 9.2.2

CPE2.3

External links

http://advisory.splunk.com/advisories/SVD-2024-1011
http://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2024-45731 CVE-2024-45732 CVE-2024-45733 CVE-2024-45734 CVE-2024-45735 CVE-2024-45736 CVE-2024-45737 CVE-2024-45738 CVE-2024-45739 CVE-2024-45740 CVE-2024-45741
CWE-ID	CWE-22 CWE-862 CWE-502 CWE-284 CWE-400 CWE-352 CWE-200 CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Splunk Enterprise Server applications / IDS/IPS systems, Firewalls and proxy servers
Vendor	Splunk Inc.