CVE-2024-36993
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Splunk Enterprise and Splunk Cloud Platform where low-privileged users can inject malicious JavaScript through Bulletin Messages. The injected code executes in other users' browsers when they view the bulletin. Affected users include all Splunk administrators and users who access the web interface.
💻 Affected Systems
- Splunk Enterprise
- Splunk Cloud Platform
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts through client-side attacks.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed in the context of other users' sessions.
If Mitigated
With proper input validation and output encoding, the malicious payload would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated low-privileged user access to create bulletin messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Splunk Enterprise: 9.2.2, 9.1.5, 9.0.10; Splunk Cloud Platform: 9.1.2312.200, 9.1.2308.207
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-0713
Restart Required: Yes
Instructions:
1. Backup your Splunk configuration. 2. Download appropriate patch version from Splunk downloads. 3. Stop Splunk services. 4. Apply the update. 5. Restart Splunk services. 6. Verify version and functionality.
🔧 Temporary Workarounds
Restrict Bulletin Message Creation
allLimit ability to create bulletin messages to trusted administrators only
Implement Content Security Policy
allAdd CSP headers to restrict script execution from untrusted sources
🧯 If You Can't Patch
- Restrict bulletin message creation to admin users only
- Monitor and audit all bulletin message creation activities
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface or command line: splunk versionCheck Version:
splunk versionVerify Fix Applied:
Verify version is at or above patched versions: splunk version📡 Detection & Monitoring
Log Indicators:
- Unusual bulletin message creation patterns
- JavaScript payloads in bulletin messages
- Multiple failed login attempts followed by bulletin creation
Network Indicators:
- Unexpected outbound connections from Splunk web interface
- Suspicious JavaScript loading in browser sessions
SIEM Query:
index=_internal source=*web_access.log | search "POST /services/messages/bulletin" | stats count by user