Splunk Enterprise vulnerabilities

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.

In Splunk Enterprise below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user without 'admin' or 'power' roles can trick another user into running arbitrary SPL commands through the Data Model Editor using the victim's permissions. The vulnerability is due to missing SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The attack requires phishing the victim.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary SPL pipelines from Dataset Explorer with the same privileges as that user. This is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands. The attack requires phishing the user into opening a crafted link.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the schedule_search capability could run arbitrary SPL commands with the highest system privilege and read every credential stored in the credential store. This is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. The XSS is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The attack requires phishing the victim.

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user without the admin or power roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the stored access token. This is possible because the app's REST API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests. The vulnerability does not affect versions 9.4 and 9.3.

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. This allows the attacker to insert code into the Splunk platform installation directory.

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code located on a separate disk.

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) references an insecure path for the OPENSSLDIR build definition. An attacker can exploit this reference to install malicious code, leading to privilege escalation on the Windows machine.

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that allows for the serialization of untrusted data. This enables the attacker to execute arbitrary code.

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed SAML request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.