CVE-2023-46214
📋 TL;DR
This vulnerability allows remote code execution on Splunk Enterprise instances by uploading malicious XSLT files. Attackers can execute arbitrary code on the server, potentially compromising the entire Splunk deployment. Affected are Splunk Enterprise versions below 9.0.7 and 9.1.2.
💻 Affected Systems
- Splunk Enterprise
📦 What is this software?
Cloud by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Splunk instance leading to data exfiltration, lateral movement within the network, and persistent backdoor installation.
Likely Case
Unauthorized access to sensitive log data, credential theft, and potential ransomware deployment.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the Splunk application itself.
🎯 Exploit Status
Exploitation requires authenticated access to upload XSLT files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.7 or 9.1.2
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2023-1104
Restart Required: Yes
Instructions:
1. Backup Splunk configuration and data. 2. Download and install Splunk Enterprise version 9.0.7 or 9.1.2 from Splunk downloads. 3. Restart Splunk services. 4. Verify version update.
🔧 Temporary Workarounds
Disable XSLT upload functionality
allRestrict or disable the ability to upload XSLT files through Splunk configuration.
Modify inputs.conf to restrict file uploads
Configure web.conf to disable XSLT processing
Network segmentation and access controls
allRestrict network access to Splunk management interfaces and implement strict authentication controls.
Configure firewall rules to limit Splunk web interface access
Implement multi-factor authentication
🧯 If You Can't Patch
- Implement strict access controls and network segmentation to limit exposure
- Monitor for suspicious XSLT file uploads and unusual process execution
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface or command line. If version is below 9.0.7 or 9.1.2, system is vulnerable.Check Version:
$SPLUNK_HOME/bin/splunk versionVerify Fix Applied:
Confirm Splunk version is 9.0.7 or higher (for 9.0.x branch) or 9.1.2 or higher (for 9.1.x branch).📡 Detection & Monitoring
Log Indicators:
- Unusual XSLT file uploads
- Suspicious process execution from Splunk user context
- Authentication anomalies
Network Indicators:
- Unexpected outbound connections from Splunk server
- Unusual traffic patterns to/from Splunk management interfaces
SIEM Query:
index=* sourcetype=splunkd (XSLT OR xslt) AND upload🔗 References
- https://advisory.splunk.com/advisories/SVD-2023-1104
- https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
- https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
- https://advisory.splunk.com/advisories/SVD-2023-1104
- https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
- https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
