Headline
CVE-2023-46214: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Advisory ID: SVD-2023-1104
Published: 2023-11-16
Last Update: 2023-11-16
CVSSv3.1 Score: 8.0, High
Description
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Solution
Upgrade Splunk Enterprise to either 9.0.7 or 9.1.2.
Splunk is actively monitoring and patching Splunk Cloud Platform instances.
Product Status
Product
Version
Component
Affected Version
Fix Version
Splunk Enterprise
9.0
Splunk Web
9.0.0 to 9.0.6
9.0.7
Splunk Enterprise
9.1
Splunk Web
9.1.0 to 9.1.1
9.1.2
Splunk Cloud
-
Splunk Web
Versions below 9.1.2308
9.1.2308
Mitigations and Workarounds
N/A
Detections
None
Severity
Splunk rates this vulnerability a 8.0, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
Related news
This Metasploit module exploits a remote code execution vulnerability in Splunk Enterprise. The affected versions include 9.0.x before 9.0.7 and 9.1.x before 9.1.2. The exploitation process leverages a weakness in the XSLT transformation functionality of Splunk. Successful exploitation requires valid credentials, typically admin:changeme by default. The exploit involves uploading a malicious XSLT file to the target system. This file, when processed by the vulnerable Splunk server, leads to the execution of arbitrary code. The module then utilizes the runshellscript capability in Splunk to execute the payload, which can be tailored to establish a reverse shell. This provides the attacker with remote control over the compromised Splunk instance. The module is designed to work seamlessly, ensuring successful exploitation under the right conditions.