https://feed.craftedsignal.io/cpes/cpe2.3asplunksplunk_cloud_platform/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 13:42:50 +0000https://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/Fri, 03 Jul 2026 13:42:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/An authenticated user can exploit CVE-2022-43571, a code injection vulnerability within Splunk Enterprise or Splunk Cloud's dashboard PDF generation component, leading to remote code execution (RCE) and potential compromise of the Splunk environment.This brief details CVE-2022-43571, a critical code injection vulnerability affecting Splunk Enterprise versions prior to 8.2.9, 8.1.12, and 9.0.2, as well as Splunk Cloud. An authenticated user can leverage this flaw by injecting arbitrary code into the dashboard PDF generation component, enabling remote code execution (RCE) on the underlying Splunk server. This vulnerability, initially identified in late 2022, can lead to complete compromise of the Splunk environment, unauthorized access, and arbitrary command execution. While the original detection logic for this vulnerability has been deprecated due to the affected versions reaching End of Life (EOL) and the detection's imperfect capture of malicious activity, the vulnerability itself remains a significant risk for any unpatched or unsupported Splunk instances.

Attack Chain

1. Initial Access: An authenticated attacker gains access to the Splunk Web User Interface (UI), potentially via compromised or stolen credentials.
2. Interaction: The attacker navigates to a Splunk dashboard or a saved search configured to allow PDF exports.
3. Malicious Input: The attacker crafts a specific HTTP request targeting the PDF generation endpoint (e.g., /en-US/splunkd/__raw/services/pdfgen/render) and injects malicious code into a vulnerable input parameter, such as the file=export parameter.
4. Code Injection: The Splunk server's dashboard PDF generation component processes the attacker's input without adequate sanitization, resulting in the injection of the malicious code into the server-side process.
5. Remote Execution: The injected code is executed on the underlying server with the privileges of the Splunk process, successfully achieving remote code execution (RCE).
6. System Compromise: With RCE, the attacker gains full control over the Splunk host, enabling them to execute arbitrary commands, exfiltrate sensitive data, or establish further persistence within the network.

Impact

Successful exploitation of CVE-2022-43571 allows an attacker to achieve remote code execution on the Splunk instance, leading to a complete compromise of the Splunk environment. This could result in unauthorized access to sensitive data indexed by Splunk, arbitrary command execution on the host server, and the ability to pivot to other systems within the compromised network. While the affected Splunk versions (8.1.12, 8.2.9, and 9.0.2) have reached End of Life (EOL) between 2023 and 2024, organizations still running these unsupported versions remain at severe risk.

Recommendation

• Patch CVE-2022-43571 immediately by upgrading Splunk Enterprise instances beyond versions 8.2.9, 8.1.12, and 9.0.2.
• Ensure Splunk Cloud deployments are updated to the latest secure versions.
• Monitor Splunk's _internal index for suspicious activity, specifically related to uri_path=*/data/ui/views/* or uri_path=*saved/searches/* combined with unusual parameters or error codes (e.g., status codes in the 4xx or 5xx range) as indicated in the original analytic logic.

]]>highadvisorysplunkvulnerabilityrcecode-injectionapplication-vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-splunk-xss-privesc/Fri, 03 Jul 2026 13:41:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-xss-privesc/A critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-36992, affects Splunk Enterprise and Splunk Cloud Platform, allowing attackers to achieve privilege escalation by exploiting custom URLs within Splunk dashboards via malicious POST requests to the `splunk_internal_metrics/data/ui/views` endpoint, leading to the creation of new user accounts with elevated access permissions on the Splunk server.A critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-36992, affects Splunk Enterprise and Splunk Cloud Platform. This flaw allows attackers to achieve privilege escalation by exploiting custom URLs within Splunk dashboards. Malicious POST requests targeting the splunk_internal_metrics/data/ui/views endpoint can inject and execute arbitrary JavaScript. Upon execution, typically when a privileged user views the compromised dashboard, the XSS payload facilitates the creation of new user accounts with elevated access permissions on the Splunk server. This vulnerability presents a significant risk, enabling unauthorized administrative control and potential data exfiltration or manipulation within the Splunk environment. Defenders should prioritize patching and monitoring for the specific POST requests and subsequent user creation events.

Attack Chain

1. Initial Access / Vulnerability Exploitation (T1189): An attacker, potentially with low-privileged access, injects malicious JavaScript into a custom URL field within a Splunk dashboard, exploiting the CVE-2024-36992 XSS vulnerability.
2. Payload Delivery (T1059.004): The crafted XSS payload is delivered via a POST request to the internal Splunk endpoint /splunk_internal_metrics/data/ui/views, embedding the malicious script within the dashboard configuration.
3. Triggering (T1203): A privileged Splunk user (e.g., an administrator) accesses or views the compromised dashboard containing the malicious custom URL.
4. Client-Side Execution (T1059.004): The embedded JavaScript executes in the context of the privileged user's browser, leveraging their authenticated session within the Splunk interface.
5. Privilege Escalation Action (T1068 / T1098): The executed script issues commands to the Splunk API, such as audittrail actions, to create a new user account with administrative or other high-level privileges.
6. Persistence / Unauthorized Account Creation (T1136.001): A new user account with elevated permissions is successfully created on the Splunk server, granting the attacker persistent access and control.
7. Post-Exploitation (TA0011): The attacker utilizes the newly created privileged account to perform further malicious activities, including data exfiltration, system configuration changes, or deployment of additional implants.

Impact

The successful exploitation of CVE-2024-36992 leads directly to privilege escalation within the Splunk environment. This enables unauthorized attackers to create new user accounts with administrative or other high-level privileges, effectively gaining full control over the Splunk instance. Such compromise can result in sensitive data exfiltration, manipulation of critical log data, disruption of Splunk services, or the use of the Splunk server as a pivot point for further attacks against integrated systems. While the number of victims is not specified, all organizations utilizing affected versions of Splunk Enterprise and Splunk Cloud Platform are at risk of severe data integrity and confidentiality breaches.

Recommendation

• Patch CVE-2024-36992 immediately by applying the latest security updates provided by Splunk, available through the official advisory at https://advisory.splunk.com/.
• Deploy the provided Sigma rule "Detect POST Requests to Splunk UI View Endpoint (CVE-2024-36992)" to identify suspicious activity targeting the splunk_internal_metrics/data/ui/views endpoint.
• Deploy the provided Sigma rule "Detect High-Privilege Splunk User Creation (CVE-2024-36992 Context)" to monitor for unauthorized administrative user account creation.
• Ensure full logging is enabled for Splunk's internal indexes, specifically _audit and _internal, as these are critical log sources for detecting this threat.

]]>highadvisoryxssprivilege-escalationsplunkcvevulnerability