CVE-2024-29945
📋 TL;DR
Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9 may expose authentication tokens during validation when debug logging is enabled. This allows attackers to capture valid tokens and potentially impersonate users. Organizations running affected Splunk versions with debug logging enabled are vulnerable.
💻 Affected Systems
- Splunk Enterprise
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture valid authentication tokens, gain unauthorized access to Splunk Enterprise, and potentially compromise sensitive log data or pivot to other systems.
Likely Case
Attackers with access to debug logs obtain authentication tokens and gain unauthorized access to Splunk data and functionality.
If Mitigated
With debug logging disabled and proper access controls, the exposure surface is minimized, though underlying vulnerability remains.
🎯 Exploit Status
Exploitation requires access to debug logs where tokens are exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.1, 9.1.4, or 9.0.9
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-0301
Restart Required: Yes
Instructions:
1. Download appropriate patched version from Splunk website. 2. Backup current configuration. 3. Install update following Splunk upgrade documentation. 4. Restart Splunk services.
🔧 Temporary Workarounds
Disable Debug Logging
allDisable debug logging for JsonWebToken component and ensure Splunk is not running in debug mode.
Edit log.cfg to set category.JsonWebToken = WARN
Verify debug mode is disabled in server.conf
🧯 If You Can't Patch
- Restrict access to debug logs and Splunk management interfaces.
- Implement network segmentation to isolate Splunk instances from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface or CLI, and verify debug logging settings in log.cfg.Check Version:
splunk versionVerify Fix Applied:
Confirm version is 9.2.1, 9.1.4, or 9.0.9 or higher, and debug logging remains disabled.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Splunk
- Unusual authentication patterns
- Debug logs containing authentication tokens
Network Indicators:
- Unexpected connections to Splunk management ports
- Traffic patterns indicating token harvesting
SIEM Query:
index=_internal source=*splunkd.log* "JsonWebToken" DEBUG | search "token"