Summary: Splunk, a technology company, has addressed 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including four high-severity flaws.
Threat Actor: N/A
Victim: N/A
Key Point:
- Splunk has released security updates to address 16 vulnerabilities in its Splunk Enterprise and Cloud Platform.
- One of the vulnerabilities, CVE-2024-36985, is a Remote Code Execution (RCE) flaw that can be exploited through an external lookup in the “splunk_archiver” application.
- The vulnerability can be exploited by a low-privileged user without admin or power roles, leading to potential RCE.
Technology company Splunk addressed 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including four high-severity flaws.
The vulnerability CVE-2024-36985 is a Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise.
“In Splunk Enterprise versions below 9.0.10, 9.1.5, and 9.2.2, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could cause a Remote Code Execution through an external lookup that likely references the “splunk_archiver“ application.” reads the advisory. “The “splunk_archiver“ application likely contains a script called “copybuckets.py“ that itself references a file called “erp_launcher.py“, which would likely execute a script called “sudobash. The “sudobash“ script does not perform any input checking. Therefore it runs a bash shell with arguments supplied by the “erp_launcher.py“ file. This can lead to an RCE.”
Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue, the company also recommends disabling the “splunk_archiver“ application to temporarily mitigate the issue.
The company addressed another high-serverity bug, tracked as CVE-2024-36984, which is a Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows.
“In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.” reads the advisory. “The exploit requires the use of the collect SPL command which writes a file within the Splunk Enterprise installation. The attacker could then use this file to submit a serialized payload that could result in execution of code within the payload.”
Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue.
If users do not log in to Splunk Web on indexers in a distributed environment, disabling Splunk Web on those indexers can mitigate the issue.
Below is the list of the addressed flaws:
The company did not reveal if one of these vulnerabilities was actively exploited in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, RCE)
Source: https://securityaffairs.com/165204/security/splunk-enterprise-and-cloud-platform-flaws.html
“An interesting youtube video that may be related to the article above”