CVE-2021-3422
📋 TL;DR
A lack of validation in the Splunk-to-Splunk protocol allows attackers to cause denial-of-service in vulnerable Splunk Enterprise instances. This affects Splunk Enterprise versions before 7.3.9, 8.0.9, and 8.1.3 when configured to index Universal Forwarder traffic. Universal Forwarders themselves are not vulnerable.
💻 Affected Systems
- Splunk Enterprise
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Complete denial-of-service of Splunk Enterprise indexers, disrupting log collection, monitoring, and security operations.
Likely Case
Service disruption requiring restart of affected Splunk Enterprise instances, potentially causing data loss or gaps in monitoring.
If Mitigated
Medium severity impact requiring compromise of TLS certificates or tokens to exploit when proper security controls are implemented.
🎯 Exploit Status
Exploitation requires network access to Splunk Enterprise indexers. When TLS or tokens are used, attacker must compromise these credentials first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.9, 8.0.9, or 8.1.3
Vendor Advisory: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
Restart Required: Yes
Instructions:
1. Download appropriate patch version from Splunk downloads portal. 2. Backup current installation. 3. Stop Splunk services. 4. Install patch. 5. Restart Splunk services. 6. Verify version and functionality.
🔧 Temporary Workarounds
Enable TLS for Splunk-to-Splunk communication
allConfigure TLS encryption between forwarders and indexers to require certificate compromise for exploitation
splunk enable listen 9997 -auth admin:changeme
Implement token authentication
allConfigure token-based authentication for forwarder-to-indexer communication
splunk edit user admin -password newpassword -auth admin:changeme
🧯 If You Can't Patch
- Implement both TLS encryption and token authentication for all Splunk-to-Splunk communications
- Restrict network access to Splunk Enterprise indexers to trusted forwarders only using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check Splunk version: splunk version. If version is before 7.3.9, 8.0.9, or 8.1.3 and configured to receive Universal Forwarder traffic, system is vulnerable.Check Version:
splunk versionVerify Fix Applied:
Verify version is 7.3.9, 8.0.9, 8.1.3 or later using splunk version command and test forwarder connectivity.📡 Detection & Monitoring
Log Indicators:
- Unexpected service crashes in splunkd.log
- Connection resets in splunkd_access.log
- Failed forwarder connections
Network Indicators:
- Unusual traffic patterns to Splunk indexer ports (default 9997)
- Malformed packets to Splunk services
SIEM Query:
index=_internal source=*splunkd.log ("crash" OR "segmentation fault" OR "abnormal termination") AND ("forwarder" OR "s2s")🔗 References
- https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
- https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
