Alex Hordijk

Users without admin or power roles can create or edit scripted lookup definitions via raw configuration endpoints. This occurs because raw transforms configuration write paths fail to perform external lookup capability checks before saving scripted lookup settings.

An unauthenticated user can create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. This occurs because the endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. This flaw can be leveraged to achieve pre-authentication remote code execution with Splunk-level privileges. Approximately 1,400 instances of the software are exposed to the internet, primarily in North America and Europe, and there have been reports of limited exploitation in real-world attacks.

A low-privileged user without 'admin' or 'power' roles can cause a Denial of Service by exploiting the `coldToFrozen.sh` script within the `splunk archiver` app. The issue stems from missing input validation in the `coldToFrozen.sh` script, which allows the acceptance of arbitrary file paths and the renaming of critical directories, rendering the instance non-functional.

A user with limited privileges, lacking the 'admin' or 'power' Splunk roles, can access the `/splunkd/ raw/servicesNS/-/-/configs/conf-passwords` API endpoint. This endpoint exposes hashed or plaintext password values stored in the `passwords.conf` configuration file due to insufficient access controls. This could lead to the unauthorized disclosure of sensitive credentials.

An unauthenticated attacker could trigger a blind server-side request forgery (SSRF). This could allow an attacker to perform REST API calls on behalf of an authenticated, high-privileged user. Server-side request forgery (SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing.

A low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK HOME/var/run/splunk/apptemp" directory due to missing authorization checks. This issue allows attackers to execute arbitrary code by uploading malicious files. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Name of the Vulnerable Software and Affected Versions: PAN-OS (affected versions not specified) Description: A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker-controlled server. This attack requires network access to the firewall management interface. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise for Windows versions prior to 9.3.1 Splunk Enterprise for Windows versions prior to 9.2.3 Splunk Enterprise for Windows versions prior to 9.1.6 Description: The issue is related to incorrect restriction of the directory path name with limited access. A low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive. This could potentially lead to arbitrary file writing and remote code execution. Recommendations: For versions prior to 9.3.1, update to version 9.3.1 or later. For versions prior to 9.2.3, update to version 9.2.3 or later. For versions prior to 9.1.6, update to version 9.1.6 or later.

The issue is related to insecure session storage configuration in Splunk Enterprise for Windows, allowing a low-privileged user without the "admin" or "power" Splunk roles to perform Remote Code Execution (RCE). This is due to deficiencies in the deserialization mechanism of the Splunk Web component.

A low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the `splunk archiver` application. This issue allows for remote code execution, potentially leading to significant security breaches.

The issue is related to the improper sanitization of extensible stylesheet language transformations (XSLT) supplied by users in Splunk Enterprise. This allows an attacker to upload malicious XSLT, potentially resulting in remote code execution on the Splunk Enterprise instance. There are over 120,000 publicly exposed Splunk instances, making them vulnerable to this issue.

A file disclosure issue in the software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

The issue arises from insufficient input validation combined with a missing authorization check in the UI interface API, allowing unauthenticated OS command injection via the `ping host` argument. This is due to vulnerabilities in the `lib/ui/api.ts` and `lib/ping.ts` files.