Splunk Enterprise (< 8.1.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/splunk-enterprise--8.1.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 13:42:50 +0000Splunk Code Injection via Custom Dashboard Leading to RCE (CVE-2022-43571)https://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/Fri, 03 Jul 2026 13:42:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-splunk-rce-cve-2022-43571/An authenticated user can exploit CVE-2022-43571, a code injection vulnerability within Splunk Enterprise or Splunk Cloud's dashboard PDF generation component, leading to remote code execution (RCE) and potential compromise of the Splunk environment.This brief details CVE-2022-43571, a critical code injection vulnerability affecting Splunk Enterprise versions prior to 8.2.9, 8.1.12, and 9.0.2, as well as Splunk Cloud. An authenticated user can leverage this flaw by injecting arbitrary code into the dashboard PDF generation component, enabling remote code execution (RCE) on the underlying Splunk server. This vulnerability, initially identified in late 2022, can lead to complete compromise of the Splunk environment, unauthorized access, and arbitrary command execution. While the original detection logic for this vulnerability has been deprecated due to the affected versions reaching End of Life (EOL) and the detection's imperfect capture of malicious activity, the vulnerability itself remains a significant risk for any unpatched or unsupported Splunk instances.

Attack Chain

  1. Initial Access: An authenticated attacker gains access to the Splunk Web User Interface (UI), potentially via compromised or stolen credentials.
  2. Interaction: The attacker navigates to a Splunk dashboard or a saved search configured to allow PDF exports.
  3. Malicious Input: The attacker crafts a specific HTTP request targeting the PDF generation endpoint (e.g., /en-US/splunkd/__raw/services/pdfgen/render) and injects malicious code into a vulnerable input parameter, such as the file=export parameter.
  4. Code Injection: The Splunk server's dashboard PDF generation component processes the attacker's input without adequate sanitization, resulting in the injection of the malicious code into the server-side process.
  5. Remote Execution: The injected code is executed on the underlying server with the privileges of the Splunk process, successfully achieving remote code execution (RCE).
  6. System Compromise: With RCE, the attacker gains full control over the Splunk host, enabling them to execute arbitrary commands, exfiltrate sensitive data, or establish further persistence within the network.

Impact

Successful exploitation of CVE-2022-43571 allows an attacker to achieve remote code execution on the Splunk instance, leading to a complete compromise of the Splunk environment. This could result in unauthorized access to sensitive data indexed by Splunk, arbitrary command execution on the host server, and the ability to pivot to other systems within the compromised network. While the affected Splunk versions (8.1.12, 8.2.9, and 9.0.2) have reached End of Life (EOL) between 2023 and 2024, organizations still running these unsupported versions remain at severe risk.

Recommendation

  • Patch CVE-2022-43571 immediately by upgrading Splunk Enterprise instances beyond versions 8.2.9, 8.1.12, and 9.0.2.
  • Ensure Splunk Cloud deployments are updated to the latest secure versions.
  • Monitor Splunk's _internal index for suspicious activity, specifically related to uri_path=*/data/ui/views/* or uri_path=*saved/searches/* combined with unusual parameters or error codes (e.g., status codes in the 4xx or 5xx range) as indicated in the original analytic logic.
]]>highadvisorysplunkvulnerabilityrcecode-injectionapplication-vulnerability