https://feed.craftedsignal.io/cpes/cpe2.3asplunksplunkenterprise/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 13:42:50 +0000https://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/Fri, 03 Jul 2026 13:42:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/An authenticated user can exploit CVE-2022-43571, a code injection vulnerability within Splunk Enterprise or Splunk Cloud's dashboard PDF generation component, leading to remote code execution (RCE) and potential compromise of the Splunk environment.This brief details CVE-2022-43571, a critical code injection vulnerability affecting Splunk Enterprise versions prior to 8.2.9, 8.1.12, and 9.0.2, as well as Splunk Cloud. An authenticated user can leverage this flaw by injecting arbitrary code into the dashboard PDF generation component, enabling remote code execution (RCE) on the underlying Splunk server. This vulnerability, initially identified in late 2022, can lead to complete compromise of the Splunk environment, unauthorized access, and arbitrary command execution. While the original detection logic for this vulnerability has been deprecated due to the affected versions reaching End of Life (EOL) and the detection's imperfect capture of malicious activity, the vulnerability itself remains a significant risk for any unpatched or unsupported Splunk instances.

Attack Chain

1. Initial Access: An authenticated attacker gains access to the Splunk Web User Interface (UI), potentially via compromised or stolen credentials.
2. Interaction: The attacker navigates to a Splunk dashboard or a saved search configured to allow PDF exports.
3. Malicious Input: The attacker crafts a specific HTTP request targeting the PDF generation endpoint (e.g., /en-US/splunkd/__raw/services/pdfgen/render) and injects malicious code into a vulnerable input parameter, such as the file=export parameter.
4. Code Injection: The Splunk server's dashboard PDF generation component processes the attacker's input without adequate sanitization, resulting in the injection of the malicious code into the server-side process.
5. Remote Execution: The injected code is executed on the underlying server with the privileges of the Splunk process, successfully achieving remote code execution (RCE).
6. System Compromise: With RCE, the attacker gains full control over the Splunk host, enabling them to execute arbitrary commands, exfiltrate sensitive data, or establish further persistence within the network.

Impact

Successful exploitation of CVE-2022-43571 allows an attacker to achieve remote code execution on the Splunk instance, leading to a complete compromise of the Splunk environment. This could result in unauthorized access to sensitive data indexed by Splunk, arbitrary command execution on the host server, and the ability to pivot to other systems within the compromised network. While the affected Splunk versions (8.1.12, 8.2.9, and 9.0.2) have reached End of Life (EOL) between 2023 and 2024, organizations still running these unsupported versions remain at severe risk.

Recommendation

• Patch CVE-2022-43571 immediately by upgrading Splunk Enterprise instances beyond versions 8.2.9, 8.1.12, and 9.0.2.
• Ensure Splunk Cloud deployments are updated to the latest secure versions.
• Monitor Splunk's _internal index for suspicious activity, specifically related to uri_path=*/data/ui/views/* or uri_path=*saved/searches/* combined with unusual parameters or error codes (e.g., status codes in the 4xx or 5xx range) as indicated in the original analytic logic.

]]>highadvisorysplunkvulnerabilityrcecode-injectionapplication-vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-splunk-xss-privesc/Fri, 03 Jul 2026 13:41:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-xss-privesc/A critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-36992, affects Splunk Enterprise and Splunk Cloud Platform, allowing attackers to achieve privilege escalation by exploiting custom URLs within Splunk dashboards via malicious POST requests to the `splunk_internal_metrics/data/ui/views` endpoint, leading to the creation of new user accounts with elevated access permissions on the Splunk server.A critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-36992, affects Splunk Enterprise and Splunk Cloud Platform. This flaw allows attackers to achieve privilege escalation by exploiting custom URLs within Splunk dashboards. Malicious POST requests targeting the splunk_internal_metrics/data/ui/views endpoint can inject and execute arbitrary JavaScript. Upon execution, typically when a privileged user views the compromised dashboard, the XSS payload facilitates the creation of new user accounts with elevated access permissions on the Splunk server. This vulnerability presents a significant risk, enabling unauthorized administrative control and potential data exfiltration or manipulation within the Splunk environment. Defenders should prioritize patching and monitoring for the specific POST requests and subsequent user creation events.

Attack Chain

1. Initial Access / Vulnerability Exploitation (T1189): An attacker, potentially with low-privileged access, injects malicious JavaScript into a custom URL field within a Splunk dashboard, exploiting the CVE-2024-36992 XSS vulnerability.
2. Payload Delivery (T1059.004): The crafted XSS payload is delivered via a POST request to the internal Splunk endpoint /splunk_internal_metrics/data/ui/views, embedding the malicious script within the dashboard configuration.
3. Triggering (T1203): A privileged Splunk user (e.g., an administrator) accesses or views the compromised dashboard containing the malicious custom URL.
4. Client-Side Execution (T1059.004): The embedded JavaScript executes in the context of the privileged user's browser, leveraging their authenticated session within the Splunk interface.
5. Privilege Escalation Action (T1068 / T1098): The executed script issues commands to the Splunk API, such as audittrail actions, to create a new user account with administrative or other high-level privileges.
6. Persistence / Unauthorized Account Creation (T1136.001): A new user account with elevated permissions is successfully created on the Splunk server, granting the attacker persistent access and control.
7. Post-Exploitation (TA0011): The attacker utilizes the newly created privileged account to perform further malicious activities, including data exfiltration, system configuration changes, or deployment of additional implants.

Impact

The successful exploitation of CVE-2024-36992 leads directly to privilege escalation within the Splunk environment. This enables unauthorized attackers to create new user accounts with administrative or other high-level privileges, effectively gaining full control over the Splunk instance. Such compromise can result in sensitive data exfiltration, manipulation of critical log data, disruption of Splunk services, or the use of the Splunk server as a pivot point for further attacks against integrated systems. While the number of victims is not specified, all organizations utilizing affected versions of Splunk Enterprise and Splunk Cloud Platform are at risk of severe data integrity and confidentiality breaches.

Recommendation

• Patch CVE-2024-36992 immediately by applying the latest security updates provided by Splunk, available through the official advisory at https://advisory.splunk.com/.
• Deploy the provided Sigma rule "Detect POST Requests to Splunk UI View Endpoint (CVE-2024-36992)" to identify suspicious activity targeting the splunk_internal_metrics/data/ui/views endpoint.
• Deploy the provided Sigma rule "Detect High-Privilege Splunk User Creation (CVE-2024-36992 Context)" to monitor for unauthorized administrative user account creation.
• Ensure full logging is enabled for Splunk's internal indexes, specifically _audit and _internal, as these are critical log sources for detecting this threat.

]]>highadvisoryxssprivilege-escalationsplunkcvevulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-splunk-user-enumeration/Fri, 03 Jul 2026 13:40:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-user-enumeration/An attacker is attempting to enumerate valid Splunk usernames by repeatedly submitting failed authentication attempts from a single source, as detected by monitoring the `_audit` index for multiple login failures, which is a precursor to credential-based attacks like password spraying or brute force, potentially leading to unauthorized access and sensitive data exposure.This brief describes detection logic aimed at identifying attempts to enumerate valid usernames within Splunk Enterprise or Splunk Cloud environments. Threat actors initiate numerous failed authentication attempts from a single source IP address against a Splunk instance's login interface. By observing the responses (e.g., specific error messages or timing differences), attackers can discern which usernames are valid, even if the password is incorrect. This activity is a critical precursor to more advanced attacks such as password spraying or brute-force credential attacks, as outlined in the linked Splunk security content. While the detection specifically targets user enumeration, it can also help identify broader credential-based attack campaigns. The behavior is observable within Splunk's internal _audit index, which records authentication events. A related security advisory for Splunk's login page, CVE-2021-33845, pertains to a Cross-site Scripting vulnerability, though this brief's detection focuses on enumeration behavior rather than direct exploitation of that specific CVE.

Attack Chain

1. Reconnaissance & Target Identification: Attacker identifies a publicly accessible Splunk instance via open-source intelligence or scanning.
2. Initial Enumeration Attempt: Attacker initiates multiple authentication attempts using common or guessed usernames (e.g., admin, splunkadmin, user1) combined with incorrect passwords.
3. Failed Authentication Logging: The Splunk instance processes these login attempts and logs failures (action=login, status=failure) in its internal _audit index.
4. Response Analysis: Attacker analyzes the HTTP responses or error messages from the Splunk login interface, or relies on the sheer volume of failed attempts, to distinguish between invalid usernames and valid usernames with incorrect passwords.
5. Username List Generation: A list of confirmed valid Splunk usernames is compiled based on the enumeration results.
6. Credential-Based Attack Preparation: The attacker uses the gathered valid usernames for subsequent credential-based attacks such as password spraying or brute-forcing.
7. Initial Access Attempt: Attacker attempts to log into the Splunk instance using the valid usernames and compromised or guessed passwords.
8. Unauthorized Access & Impact: Successful login grants unauthorized access to the Splunk environment, potentially leading to sensitive data exfiltration, dashboard manipulation, or further compromise of integrated systems.

Impact

Successful user enumeration provides threat actors with a critical piece of information—valid usernames—that significantly streamlines subsequent credential-based attacks. If these attacks succeed, they can lead to unauthorized access to the Splunk environment. This unauthorized access can result in the exposure, modification, or deletion of sensitive enterprise data, compromise of security monitoring capabilities, and serve as a pivot point for lateral movement into other systems. The integrity and confidentiality of data managed or monitored by Splunk instances are at severe risk.

Recommendation

• Review the _audit index for action=login events with status=failure that show a high count from a single src IP address targeting different user accounts, indicating potential user enumeration attempts.
• Implement strong account lockout policies within Splunk to deter brute-force and password spraying attacks that leverage enumerated usernames.
• Ensure multi-factor authentication (MFA) is enforced for all Splunk user accounts, especially those with administrative privileges.
• Monitor for high volumes of failed login attempts against your Splunk infrastructure and investigate their source and targeted accounts.
• Regularly rotate credentials for Splunk accounts and enforce complex password requirements.

]]>mediumadvisoryuser-enumerationsplunkauthenticationapplicationhttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-xslt/Fri, 03 Jul 2026 13:39:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-xslt/This brief identifies potential remote code execution (RCE) attempts targeting Splunk servers by exploiting CVE-2023-46214, a vulnerability related to user-supplied Extensible Stylesheet Language Transformations (XSLT) that allows attackers to execute arbitrary code leading to full system compromise.Attackers are targeting Splunk Enterprise and Splunk Cloud Platform instances by exploiting CVE-2023-46214, an issue related to the improper handling of user-supplied Extensible Stylesheet Language Transformations (XSLT). This vulnerability, affecting Splunk Enterprise versions prior to 9.0.7 and 9.1.2, and Splunk Cloud Platform versions prior to 9.0.2308 and 9.1.2308, allows an authenticated user to achieve remote code execution on the underlying Splunk server. The attack typically involves crafting a malicious XSLT payload and submitting it through an interface that processes user-controlled XSLT. Successful exploitation can grant threat actors full control over the Splunk instance, enabling unauthorized data access, system modification, and further lateral movement within the compromised network. Defenders should prioritize patching and monitoring for indicators of attempted exploitation in their splunkd_ui logs.

Attack Chain

1. Initial Access / Account Compromise: An attacker gains access to a valid Splunk user account or identifies a publicly accessible endpoint that processes user-supplied XSLT without proper sanitization.
2. Malicious XSLT Crafting: The attacker develops a specialized XSLT file containing malicious code designed to exploit CVE-2023-46214, targeting the Splunk server's underlying operating system.
3. XSLT Submission: The malicious XSLT payload is submitted to the vulnerable Splunk instance, typically through an API endpoint or UI feature that accepts XSLT definitions.
4. Vulnerability Trigger: The Splunk instance attempts to process the user-supplied XSLT, which triggers the remote code execution vulnerability (CVE-2023-46214).
5. Code Execution: The malicious XSLT causes the Splunk server to execute arbitrary commands under the privileges of the Splunk daemon.
6. Post-Exploitation Actions: The attacker runs commands on the Splunk server, such as creating new user accounts, deploying backdoors, or executing reconnaissance tools.
7. Impact: The attacker proceeds with objectives such as data exfiltration from Splunk indexes, system compromise, or using the Splunk server as a pivot point for lateral movement.

Impact

Successful exploitation of CVE-2023-46214 leads to critical consequences for affected organizations. Attackers can achieve full system compromise of the Splunk server, gaining complete control over the application and the underlying host. This allows for unauthorized access to sensitive data stored within Splunk indexes, potentially exfiltrating proprietary information, customer data, or security logs. Furthermore, the compromised Splunk instance can be used as a beachhead for lateral movement across the network, enabling broader attacks and impacting multiple systems. The number of potential victims is significant, as Splunk is widely deployed across various sectors for security and operational intelligence.

Recommendation

• Immediately patch all Splunk Enterprise instances to versions 9.0.7 or later, or 9.1.2 or later, and Splunk Cloud Platform instances to versions 9.0.2308 or later, or 9.1.2308 or later to remediate CVE-2023-46214.
• Deploy the provided Sigma rule to your SIEM to detect potential exploitation attempts against Splunk instances.
• Review splunkd_ui logs for URIs containing NO_BINARY_CHECK=1, input.path=*.xsl, or dispatch*.xsl which could indicate ongoing or attempted exploitation of CVE-2023-46214.
• Investigate any detections of the provided Sigma rule, paying close attention to the clientip, useragent, and status fields to determine the nature and source of the activity.

]]>criticaladvisoryapplicationrcesplunkvulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-arbitrary-file-write/Fri, 03 Jul 2026 13:38:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-arbitrary-file-write/A critical vulnerability (CVE-2024-45731, CVE-2024-45733) in Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6 allows low-privileged users to perform arbitrary file writes to the Windows system root directory (C:\Windows\System32) when Splunk is installed on a separate drive, enabling remote code execution through insecure session storage configuration.This threat concerns two critical vulnerabilities, CVE-2024-45731 and CVE-2024-45733, identified in Splunk Enterprise for Windows. Specifically, versions prior to 9.3.0, 9.2.3, and 9.1.6 are affected. These flaws enable a low-privileged user, even without 'admin' or 'power' Splunk roles, to write arbitrary files to the Windows system root directory, typically C:\Windows\System32, especially when Splunk is installed on a drive separate from the system root. This arbitrary file write, combined with an insecure session storage configuration, creates a path for remote code execution. Attackers can leverage this to upload and execute malicious code, leading to full system compromise. Detection engineers should prioritize identifying attempts to access vulnerable Splunk API endpoints and monitoring for unusual application creation events by unprivileged users.

Attack Chain

1. Initial Access: An attacker gains or already possesses a low-privileged user account on a Splunk Enterprise for Windows instance, lacking 'admin' or 'power' capabilities.
2. Exploit Initiation: The attacker sends a specially crafted HTTP POST request to the vulnerable Splunk API endpoint, /search/apps/local/_new.
3. Arbitrary File Write (CVE-2024-45731): The successful request exploits CVE-2024-45731, allowing the attacker to write a malicious file (e.g., a DLL, executable, or script) to the Windows system root directory (C:\Windows\System32). This is particularly effective when Splunk is installed on a non-system drive.
4. Code Upload via Insecure Session Storage (CVE-2024-45733): The attacker leverages CVE-2024-45733's insecure session storage configuration to facilitate the upload and persistent storage of the malicious code.
5. Remote Code Execution: The malicious file previously written to C:\Windows\System32 is subsequently executed, leading to remote code execution on the underlying Splunk server.
6. System Compromise: With RCE, the attacker gains elevated privileges and full control over the compromised Splunk server, enabling further actions.
7. Post-Exploitation Activities: The attacker can now perform actions such as data exfiltration from Splunk's internal data, deploy additional malware for persistence, establish lateral movement, or disrupt Splunk operations.

Impact

The successful exploitation of these vulnerabilities leads to remote code execution on the affected Splunk Enterprise for Windows server. This grants the attacker full control over the compromised system, potentially with SYSTEM-level privileges if the Splunk service runs as such. Consequences include unauthorized access to sensitive data processed and stored by Splunk, complete compromise of the Splunk environment, and the ability to pivot to other systems within the network. This can result in significant data breaches, operational disruption, and the establishment of persistent backdoors, impacting the integrity and availability of critical security and operational data.

Recommendation

• Patch Immediately: Apply patches for CVE-2024-45731 and CVE-2024-45733 by upgrading Splunk Enterprise for Windows to versions 9.3.0, 9.2.3, 9.1.6, or newer as per Splunk's advisories.
• Deploy Detection Rules: Deploy the "Detect CVE-2024-45731/CVE-2024-45733 Exploitation Attempt - Splunk Vulnerable Endpoint Access" and "Detect CVE-2024-45731/CVE-2024-45733 Exploitation - Splunk Low-Privilege App Creation Error" Sigma rules to your SIEM.
• Monitor Splunk Internal Logs: Ensure that _internal index logs, specifically splunkd_access and splunk_python sourcetypes, are being collected and monitored for suspicious activity.
• Investigate Detections: Investigate any alerts generated by the provided Sigma rules for activities related to the */search/apps/local/_new endpoint or privilege errors for low-privileged users.

]]>highadvisoryapplication-vulnerabilityrcefile-writeprivilege-escalationsplunkwindowshttps://feed.craftedsignal.io/briefs/2026-07-splunk-token-exposure/Fri, 03 Jul 2026 13:37:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-token-exposure/A critical vulnerability, CVE-2024-29945, allows for the exposure of authentication tokens in debug logs within Splunk Enterprise and Splunk Cloud, enabling an attacker with access to internal log files to gain unauthorized access, exfiltrate data, and potentially achieve full compromise of the Splunk infrastructure if unpatched versions (prior to 9.2.1, 9.1.4, and 9.0.9 for Enterprise) are in use.This brief details the implications of CVE-2024-29945, a vulnerability affecting Splunk Enterprise versions prior to 9.2.1, 9.1.4, and 9.0.9, as well as Splunk Cloud. The vulnerability causes sensitive authentication tokens, specifically JSON Web Tokens (JWTs), to be inadvertently logged in splunkd debug logs when the JsonWebToken component is configured for DEBUG level logging. If an attacker gains access to the underlying Splunk server's file system or its internal logs, these exposed tokens can be retrieved and reused to bypass authentication, gaining unauthorized access to the Splunk environment. This could lead to a range of malicious activities, including sensitive data exfiltration, privilege escalation within Splunk, and ultimately, a full compromise of the Splunk deployment. This exposure highlights the critical need for proper log configuration and timely patching to mitigate significant security risks.

Attack Chain

1. Initial Access to Splunk Server/Logs: An attacker first obtains unauthorized access to the Splunk server's underlying operating system or gains privileged access to Splunk's internal logging mechanisms (e.g., via a compromised administrative account or another vulnerability).
2. Locate Debug Logs: The attacker navigates to the Splunk internal log directories (e.g., /opt/splunk/var/log/splunk/splunkd.log on Linux) where splunkd debug logs are stored.
3. Identify Token Exposure: The attacker searches through the splunkd logs for entries originating from the JsonWebToken component at DEBUG log level, specifically looking for messages like "Validating token:".
4. Extract JWT: The attacker parses the identified log entries to extract the full JSON Web Token (JWT) value, which contains authentication credentials.
5. Token Replay/Impersonation: The extracted JWT is then used to craft authenticated API requests or session cookies, allowing the attacker to impersonate the legitimate user whose token was exposed.
6. Unauthorized Access to Splunk: The attacker gains unauthorized access to the Splunk user's account, bypassing normal authentication processes.
7. Data Exfiltration/Privilege Escalation: With compromised access, the attacker can then exfiltrate sensitive data stored or processed by Splunk, create new users, modify configurations, or escalate privileges within the Splunk environment.
8. Full Compromise: Ultimately, the attacker may achieve full control over the Splunk deployment, leveraging its capabilities for further reconnaissance, lateral movement, or destruction of data.

Impact

The impact of CVE-2024-29945 is severe, as exposed authentication tokens can serve as direct access keys to a Splunk environment. If successfully exploited, attackers can gain unauthorized access to all data and functionalities accessible by the compromised token's legitimate owner, potentially leading to sensitive data exfiltration, system tampering, and privilege escalation. While specific victim counts are not publicly disclosed, this vulnerability affects widely deployed Splunk Enterprise and Splunk Cloud instances across all sectors. Organizations using affected versions face risks including compliance violations due to data breaches, operational disruption, and significant reputational damage. The ability to bypass authentication can compromise the integrity and confidentiality of an organization's critical monitoring and security intelligence platform.

Recommendation

• Patch CVE-2024-29945 immediately: Update Splunk Enterprise to versions 9.2.1, 9.1.4, 9.0.9, or later to address CVE-2024-29945, which mitigates the token exposure in debug logs.
• Deploy the provided Sigma rule: Implement the "Detect Splunk Authentication Token Exposure in Debug Logs" Sigma rule in your SIEM to identify instances where JWTs are logged in plain text within splunkd debug logs.
• Configure Splunk logging: Review and adjust Splunk logging configurations to ensure JsonWebToken component logging is not set to DEBUG level in production environments unless absolutely necessary for troubleshooting.
• Monitor internal Splunk logs: Routinely monitor Splunk internal logs (_internal index) for the behavior described in the "Detect Splunk Authentication Token Exposure in Debug Logs" rule, specifically for events containing Validating token: from the JsonWebToken component.

]]>highadvisorysplunkvulnerabilitytoken-exposurelog-analysisapplication