SB2024101514 - Multiple vulnerabilities in Splunk Enterprise
Published: October 15, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2024-45731)
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to input validation error when processing filenames. A remote user can write a .dll file to the Windows system root directory, which has a default
location in the Windows System32 folder, and execute it with elevated privileges.
Note, the vulnerability affects Splunk Enterprise for
Windows when installed on a separate drive.
2) Missing Authorization (CVE-ID: CVE-2024-45732)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to missing authorization checks. A remote user can run a search as the “nobody” Splunk user in the SplunkDeploymentServerConfig app and gain access to sensitive information.
3) Deserialization of Untrusted Data (CVE-ID: CVE-2024-45733)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insecure session storage configuration. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.
Note, the vulnerability affects Splunk Enterprise for Windows.
4) Improper access control (CVE-ID: CVE-2024-45734)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
5) Improper access control (CVE-ID: CVE-2024-45735)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and view the App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.
6) Resource exhaustion (CVE-ID: CVE-2024-45736)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can initiate a search query with an improperly-formatted “INGEST_EVAL” parameter as part of a Field Transformation and crash the Splunk daemon (splunkd).
7) Cross-site request forgery (CVE-ID: CVE-2024-45737)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website and change the maintenance mode state of App Key Value Store (KVStore).
8) Information disclosure (CVE-ID: CVE-2024-45738)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to software exposes sensitive HTTP parameters to the _internal index when the REST_Calls log channel is configured at the DEBUG logging level. A remote privileged user can gain access to sensitive information.
9) Information disclosure (CVE-ID: CVE-2024-45739)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to application exposes plaintext passwords for local native authentication Splunk users when the Splunk Enterprise AdminManager log channel is configured at the DEBUG logging level. A remote privileged user can gain access to sensitive information.
10) Stored cross-site scripting (CVE-ID: CVE-2024-45740)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject a malicious payload through Scheduled Views and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
11) Stored cross-site scripting (CVE-ID: CVE-2024-45741)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can create a malicious payload through a custom configuration file and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.
References
- https://advisory.splunk.com/advisories/SVD-2024-1001
- https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/
- https://advisory.splunk.com/advisories/SVD-2024-1002
- https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/
- https://advisory.splunk.com/advisories/SVD-2024-1003
- https://advisory.splunk.com/advisories/SVD-2024-1004
- https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/
- https://advisory.splunk.com/advisories/SVD-2024-1005
- https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/
- https://advisory.splunk.com/advisories/SVD-2024-1006
- https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/
- https://advisory.splunk.com/advisories/SVD-2024-1007
- https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/
- https://advisory.splunk.com/advisories/SVD-2024-1008
- https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/
- https://advisory.splunk.com/advisories/SVD-2024-1009
- https://advisory.splunk.com/advisories/SVD-2024-1010
- https://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25/
- https://advisory.splunk.com/advisories/SVD-2024-1011
- https://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/