CVE-2024-36995
📋 TL;DR
This CVE allows low-privileged users without admin or power roles to create experimental items in Splunk Enterprise and Splunk Cloud Platform. This violates intended access controls and could enable unauthorized configuration changes. Affected users include organizations running vulnerable Splunk versions below specified patches.
💻 Affected Systems
- Splunk Enterprise
- Splunk Cloud Platform
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users create experimental items that disrupt Splunk functionality, modify configurations, or create persistence mechanisms for further attacks.
Likely Case
Low-privileged users create experimental items that could cause operational issues or configuration drift, requiring administrative cleanup.
If Mitigated
With proper role-based access controls and monitoring, impact is limited to minor configuration issues that can be quickly detected and reverted.
🎯 Exploit Status
Requires authenticated low-privileged user access. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Splunk Enterprise 9.2.2, 9.1.5, 9.0.10; Splunk Cloud Platform 9.1.2312.200, 9.1.2308.207
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-0715
Restart Required: Yes
Instructions:
1. Backup Splunk configuration and data. 2. Download appropriate patch version from Splunk downloads. 3. Stop Splunk services. 4. Apply patch following Splunk upgrade documentation. 5. Restart Splunk services. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict Experimental Item Creation
allModify role permissions to prevent low-privileged users from creating experimental items.
splunk edit user <username> -role <role_without_experimental_permissions>
splunk edit role <rolename> -capability edit_experimental false
🧯 If You Can't Patch
- Review and audit user roles to ensure only authorized users have experimental item creation capabilities.
- Implement monitoring for unauthorized experimental item creation in Splunk audit logs.
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface or CLI. If version is below patched versions, system is vulnerable.Check Version:
splunk versionVerify Fix Applied:
After patching, verify version is at or above patched versions and test that low-privileged users cannot create experimental items.📡 Detection & Monitoring
Log Indicators:
- Audit logs showing experimental item creation by non-admin/power users
- Unauthorized configuration changes in experimental items
Network Indicators:
- Unusual API calls to experimental endpoints from non-privileged accounts
SIEM Query:
index=_audit action="edit_experimental" user!=admin user!=power | stats count by user