CVE-2022-32156
📋 TL;DR
Splunk Enterprise and Universal Forwarder versions before 9.0 do not validate TLS certificates by default when the CLI connects to remote Splunk instances. This allows machine-in-the-middle attackers to intercept and potentially manipulate communications between Splunk components. Only on-premises Splunk deployments are affected, not Splunk Cloud Platform.
💻 Affected Systems
- Splunk Enterprise
- Splunk Universal Forwarder
📦 What is this software?
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive Splunk data, inject malicious commands, or steal credentials during CLI communications with remote Splunk instances.
Likely Case
In targeted attacks, attackers could intercept configuration data or administrative commands between Splunk components in environments with existing network access.
If Mitigated
With proper TLS certificate validation enabled, all CLI communications are authenticated and encrypted, preventing interception.
🎯 Exploit Status
Requires machine-in-the-middle position and specific conditions. No evidence of external exploitation at time of disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0 or later
Vendor Advisory: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
Restart Required: Yes
Instructions:
1. Upgrade to Splunk 9.0 or later. 2. Enable TLS certificate validation by setting 'cliVerifyServerName = true' in server.conf. 3. Restart Splunk services.
🔧 Temporary Workarounds
Enable TLS certificate validation manually
allConfigure Splunk to validate TLS certificates for CLI connections without upgrading
Edit $SPLUNK_HOME/etc/system/local/server.conf
Add: [general]
Add: cliVerifyServerName = true
Restart Splunk
🧯 If You Can't Patch
- Restrict network access to Splunk CLI communications using firewalls or network segmentation
- Monitor for unusual network traffic patterns between Splunk components
🔍 How to Verify
Check if Vulnerable:
Check Splunk version and verify if 'cliVerifyServerName' is set to true in server.confCheck Version:
$SPLUNK_HOME/bin/splunk versionVerify Fix Applied:
Confirm version is 9.0+ and 'cliVerifyServerName = true' is present in server.conf📡 Detection & Monitoring
Log Indicators:
- Failed TLS certificate validation errors in splunkd.log
- Unusual CLI connection patterns
Network Indicators:
- Unencrypted or unexpected TLS handshakes between Splunk instances
- MITM attack patterns in network traffic
SIEM Query:
source="*splunkd.log" "certificate" "validation" "failed" OR "cliVerifyServerName"🔗 References
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
