Therceman

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.2, 9.2.4, and 9.1.7 Splunk Secure Gateway app on Splunk Cloud Platform versions prior to 3.2.462, 3.7.18, and 3.8.5 Description: The issue is related to improper access control in the Splunk Secure Gateway App Key Value Store (KVstore) collections endpoints. This could allow a low-privileged user without the "admin" or "power" Splunk roles to see alert search query responses. The vulnerability may enable a remote attacker to gain unauthorized access to protected information due to insufficient protection of service data resulting from improper access control to the KV Store. Recommendations: For Splunk Enterprise versions prior to 9.3.2, 9.2.4, and 9.1.7, update to version 9.3.2, 9.2.4, or 9.1.7 or later. For Splunk Secure Gateway app on Splunk Cloud Platform versions prior to 3.2.462, 3.7.18, and 3.8.5, update to version 3.2.462, 3.7.18, or 3.8.5 or later. As a temporary workaround, consider restricting access to the KV Store collections endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6 Splunk Cloud Platform versions prior to 9.2.2403.108 Splunk Cloud Platform versions prior to 9.1.2312.204 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability in the Splunk Web component of Splunk Enterprise. This vulnerability can be exploited by a low-privileged user who does not hold the "admin" or "power" Splunk roles, allowing them to change the maintenance mode state of App Key Value Store (KVStore). The exploitation can be done through a specially crafted web page. **Recommendations** For Splunk Enterprise versions prior to 9.3.1, update to version 9.3.1 or later. For Splunk Enterprise versions prior to 9.2.3, update to version 9.2.3 or later. For Splunk Enterprise versions prior to 9.1.6, update to version 9.1.6 or later. For Splunk Cloud Platform versions prior to 9.2.2403.108, update to version 9.2.2403.108 or later. For Splunk Cloud Platform versions prior to 9.1.2312.204, update to version 9.1.2312.204 or later. As a temporary workaround, consider restricting access to the KVStore maintenance mode to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions 9.1.6, 9.2.3, and 9.3.0 Description: A low-privileged user without the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the `img` tag in the source extensible markup language (XML) code for the Splunk classic dashboard. This issue is related to insufficient access control in the PDF export feature. Recommendations: For version 9.1.6, upgrade to a newer version to mitigate the risk. For version 9.2.3, upgrade to a newer version to mitigate the risk. For version 9.3.0, upgrade to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the PDF export feature in Splunk classic dashboards until a patch is available.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Description: The issue is related to insufficient access control in the Splunk Web Bulletin Messages module of the Splunk Web interface in Splunk Enterprise. This could allow a remote attacker to impact the confidentiality and integrity of protected information by sending specially crafted notifications. A low-privileged user without admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive. Recommendations: For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later. For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later. For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later. For Splunk Cloud Platform versions prior to 9.1.2312.200, update to version 9.1.2312.200 or later. As a temporary workaround, consider restricting access to the Splunk Web Bulletin Messages module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207 **Description** A low-privileged user without admin or power Splunk roles can craft a malicious payload through Splunk Web Bulletin Messages, potentially resulting in the execution of unauthorized JavaScript code in a user's browser. **Recommendations** For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later. For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later. For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later. For Splunk Cloud Platform versions prior to 9.1.2312.200, update to version 9.1.2312.200 or later. For Splunk Cloud Platform versions prior to 9.1.2308.207, update to version 9.1.2308.207 or later.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.2.2403.100 Description: The issue is related to the datamodel/web REST endpoint in Splunk Enterprise, where an authenticated, low-privileged user could send a specially crafted HTTP POST request, potentially causing a denial of service. This is due to the execution of a loop with an unavailable exit condition. The exploitation of this issue allows a remote attacker to cause a denial of service using a specially crafted HTTP request. Recommendations: For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later. For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later. For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later. For Splunk Cloud Platform versions prior to 9.2.2403.100, update to version 9.2.2403.100 or later. As a temporary workaround, consider restricting access to the "datamodel/web" REST endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207 Description: A low-privileged user without admin or power Splunk roles could craft a malicious payload through a View, potentially resulting in the execution of unauthorized JavaScript code in a user's browser. The issue arises from the `url` parameter of the Dashboard element lacking proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit. Recommendations: For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later. For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later. For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later. For Splunk Cloud Platform versions prior to 9.1.2312.200, update to version 9.1.2312.200 or later. For Splunk Cloud Platform versions prior to 9.1.2308.207, update to version 9.1.2308.207 or later. As a temporary workaround, consider restricting access to the Dashboard element's `url` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207 Description: The issue is related to insufficient protection of service data in the Analytics Workspace module of the Splunk Web interface in Splunk Enterprise. An authenticated user could bypass security restrictions and execute arbitrary commands by sending a specially crafted request, but this requires tricking a higher-privileged user into initiating a request within their browser. Recommendations: For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later. For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later. For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later. For Splunk Cloud Platform versions prior to 9.1.2312.200, update to version 9.1.2312.200 or later. For Splunk Cloud Platform versions prior to 9.1.2308.207, update to version 9.1.2308.207 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.0.8 Splunk Enterprise versions prior to 9.1.3 **Description** The issue is related to insufficient input validation, allowing a remote attacker to gain unauthorized access to protected information using the `mrollup` SPL command. This requires user interaction from a high-privileged user to exploit. A low-privileged user can view metrics on an index they do not have permission to view. **Recommendations** For versions prior to 9.0.8, update to version 9.0.8 or later to resolve the issue. For versions prior to 9.1.3, update to version 9.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the `mrollup` SPL command until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100 **Description** A low-privileged user can perform an unauthorized transfer of data from a search using the `copyresults` command if they know the search ID (SID) of a search job that has recently run. **Recommendations** For Splunk Enterprise versions prior to 9.0.5, update to version 9.0.5 or later. For Splunk Enterprise versions prior to 8.2.11, update to version 8.2.11 or later. For Splunk Enterprise versions prior to 8.1.14, update to version 8.1.14 or later. For Splunk Cloud Platform versions prior to 9.0.2303.100, update to version 9.0.2303.100 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100 **Description** A low-privileged user with the `user` role can access the hashed version of the initial user name and password for the Splunk instance. This is achieved by using the `rest` SPL command against the "conf-user-seed" REST endpoint. **Recommendations** For Splunk Enterprise versions prior to 9.0.5, update to version 9.0.5 or later. For Splunk Enterprise versions prior to 8.2.11, update to version 8.2.11 or later. For Splunk Enterprise versions prior to 8.1.14, update to version 8.1.14 or later. For Splunk Cloud Platform versions prior to 9.0.2303.100, update to version 9.0.2303.100 or later. As a temporary workaround, consider restricting access to the "conf-user-seed" REST endpoint for low-privileged users until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 **Description** The issue allows a search to bypass safeguards for risky commands using the `display.page.search.patterns.sensitivity` search parameter. This requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled. **Recommendations** For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 **Description** The issue allows a search to bypass safeguards for risky commands using the `pivot` search processing language (SPL) command and a saved search job. This requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser. The vulnerability affects instances with Splunk Web enabled. **Recommendations** For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 **Description** A cross-site request forgery in the Splunk Secure Gateway (SSG) app in the 'kvstore client' REST endpoint allows a potential attacker to update SSG KV store collections using an HTTP GET request. The vulnerability affects instances with SSG and Splunk Web enabled. **Recommendations** For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 8.2.9 Splunk Enterprise versions prior to 8.1.12 Splunk Enterprise versions prior to 9.0.2 **Description** The issue allows an authenticated user to run risky commands using a more privileged user’s permissions, bypassing SPL safeguards for risky commands in the Analytics Workspace. This can be achieved by tricking a victim into initiating a request within their browser, effectively phishing them. The attacker cannot exploit this issue at will, requiring the victim's interaction. **Recommendations** For versions prior to 8.2.9, update to version 8.2.9 or later. For versions prior to 8.1.12, update to version 8.1.12 or later. For versions prior to 9.0.2, update to version 9.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 9.0 **Description** The issue allows an attacker to inject risky search commands into a form token when the token is used in a query in a cross-origin request, bypassing SPL safeguards for risky commands. This is a browser-based attack and cannot be exploited at will. **Recommendations** For versions prior to 9.0, update to version 9.0 or later to resolve the issue. As a temporary workaround, consider limiting access to custom and potentially risky commands using the new capabilities provided in version 9.0.