Splunk Enterprise vulnerabilities

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper adherence to coding standards. The vulnerability was internally identified and addressed in the mentioned versions.

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper input neutralization. The vulnerability was internally identified and addressed in the mentioned versions.

Vulnerability in Splunk Enterprise before versions 10.4.3 and 10.2.7 allows an unauthenticated user with network access to the Patroni REST API on a search head cluster member to execute attacker-controlled OS commands. The interface does not require authentication for critical configuration operations.

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests.

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to protection mechanism failure. The vulnerability was internally identified and addressed in the mentioned versions.

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper control of a resource through its lifetime. The issue was internally identified and grouped by CWE.

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain an improper access control vulnerability. The issue was internally identified and grouped by CWE.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user without admin or sc_admin roles could modify alert and mobile-device recipient data in App Key Value Store collections used by alert and subscription workflows. The vulnerability is due to unrestricted write access to these collections.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user with run_collect capability could use the collect SPL command to write events to internal indexes outside the role's configured index access. The vulnerability is due to lack of whitespace normalization in index names before applying access restrictions.

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user with edit_spl2_module_permissions capability could use the REST API to access permission grants for SPL2 modules they are not allowed to view. The vulnerability is due to missing verification of user's read access to the app before returning module permissions.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user with edit_user capability could create a native Splunk username ending with a period. Username validation does not reject a trailing period, causing distinct usernames to share per-user configuration data and user-management operations to affect the wrong account or fail.

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user without admin or power roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is due to embedded source maps in production JavaScript bundles.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user without admin or power roles could access search query text and job metadata for jobs belonging to other users via a REST API. The vulnerability is due to incomplete per-user authorization enforcement in search job listings.

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user with read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the REST API to an attacker-controlled host and disclose the configured Observability Cloud API token. The vulnerability is due to incomplete validation of the outbound request destination.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user with run_collect capability could use the collect SPL command to add attacker-controlled content to system-level messages. The vulnerability is due to lack of index name validation before processing the value.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user without admin or power roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is due to lack of authorization verification for signature requests.

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user without admin or power roles could cause a denial of service against a REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is due to an inefficient regular expression used for input validation.

In Splunk Enterprise versions below 10.4.3, a user with a role having the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the REST API, including private SPL2 module definitions belonging to other users. The vulnerability exists because Splunk does not parameterize user-supplied values before using them in database queries for SPL2 module filtering.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user without the admin or power roles could use a user-controlled job identifier to access substantially all search job information from jobs belonging to other users, including search query text, job metadata, results, and preview results, through a REST API. The vulnerability is due to incomplete validation of job ownership before returning search job information.

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user with the read_o11y_content capability could inject forged entries into the app log through the REST API. The vulnerability exists because the Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log.

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user without the admin or power roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is due to raw transforms configuration write paths not applying external lookup capability checks before saving scripted lookup settings.

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted REST API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability exists because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. The vulnerability is possible because knowledge bundle delta processing does not restrict removal paths to the staging directory and the endpoint does not enforce the expected authorization boundary.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability exists because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary SPL commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability exists because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments.

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary SPL commands with the victim's permissions via a crafted Splunk Web link. The vulnerability is due to substituting URL-supplied form token values into SPL searches without sanitization. The attack requires phishing the user.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.9, 3.9.23, and 3.8.70, a user without admin or power roles could use SSRF in report notifications to send system-authenticated requests to internal Splunk services, potentially altering Search Head Cluster state and causing DoS. The vulnerability is due to missing validation of report notification paths.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in another user's browser. If the victim has admin role, the script could access all data and perform actions with admin permissions. The vulnerability is due to lack of restrictions on visualization options and missing escaping of tooltip values.

In Splunk Enterprise below 10.4.2, a user with high-privilege role managing search head clustering could use the REST API to write files to locations writable by the Splunk account, potentially enabling remote code execution. The vulnerability is due to missing authorization boundary enforcement and lack of bundle path validation.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a REST API endpoint and affect system integrity on the host. The vulnerability exists because Splunk Enterprise does not validate the search identifier before using it to create a dispatch directory.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could execute arbitrary SQL queries through the Data Orchestration jobs endpoint, allowing access to data stored by Data Orchestration, including other users' jobs and stored connection credentials. The vulnerability is due to building queries without parameterization.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store risky SPL commands in a Table Editor dataset and share it. An admin user triggers the commands when opening the dataset, potentially exposing data and modifying lookup files. The vulnerability is due to missing SPL safeguards for risky commands in the field-summary search.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the "power" role can store attacker-controlled SPL in a Table Editor dataset and share it. When an "admin" user opens the dataset, the SPL executes with the admin's permissions, potentially exposing data and allowing limited modification. The vulnerability is due to missing SPL safeguards for risky commands in the Table Editor.

In Splunk Enterprise 10.4 below 10.4.2, an unauthenticated user could cause reload of token-signing keys via the REST API. The vulnerability is due to missing authentication or change_authentication capability requirement for the token-key reload action.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could inject arbitrary SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search. The vulnerability is due to insufficient input validation.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability exists because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is due to lack of restriction of static file requests to the configured static directory.

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user without admin or power roles could delete all SPL2 modules across the instance via the REST API. This could delete exported datasets and functions, affecting system integrity and causing partial service disruption.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user without edit_manager_xml capability could write a malicious Splunk Web Manager XML configuration. When the user opens the page, Splunk runs attacker-controlled OS commands.

A user with the "power" role in Splunk Enterprise can store a Dashboard Studio workflow action containing attacker-controlled SPL. When another authenticated user selects the action, Splunk runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of workflow-action URLs in Dashboard Studio.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a Dashboard Studio workflow action with a crafted URL. When another user selects it, attacker-controlled JavaScript runs in their browser.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. Splunk then runs attacker-controlled SPL with the victim's permissions.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could inject SPL into saved-search dispatch requests. This could allow unauthorized access to data and affect system integrity.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. Splunk then runs attacker-controlled SPL with the victim's permissions.