CVE-2024-45733
📋 TL;DR
In Splunk Enterprise for Windows, low-privileged users without admin or power roles can achieve remote code execution due to insecure session storage. This affects Windows installations of Splunk Enterprise versions below 9.2.3 and 9.1.6. Attackers could execute arbitrary code on vulnerable Splunk servers.
💻 Affected Systems
- Splunk Enterprise
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary code with Splunk service privileges, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Attacker gains initial foothold on Splunk server, potentially escalating privileges to compromise the entire Splunk environment and access sensitive log data.
If Mitigated
Limited impact if proper network segmentation and access controls prevent low-privileged users from reaching vulnerable endpoints.
🎯 Exploit Status
Requires authenticated low-privileged user access. The CWE-502 (Deserialization of Untrusted Data) suggests exploitation is relatively straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.3 or 9.1.6
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-1003
Restart Required: Yes
Instructions:
1. Backup Splunk configuration and data. 2. Download and install Splunk Enterprise version 9.2.3 or 9.1.6 from Splunk downloads. 3. Restart Splunk services. 4. Verify successful upgrade.
🔧 Temporary Workarounds
Restrict User Access
allLimit low-privileged user access to Splunk web interface and APIs
Network Segmentation
allIsolate Splunk servers from general user networks
🧯 If You Can't Patch
- Implement strict network access controls to limit which users can reach Splunk interfaces
- Review and minimize low-privileged user accounts with Splunk access
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface (Settings > Server Info) or command line: splunk versionCheck Version:
splunk versionVerify Fix Applied:
Confirm version is 9.2.3 or higher (for 9.2.x) or 9.1.6 or higher (for 9.1.x)📡 Detection & Monitoring
Log Indicators:
- Unusual session creation/modification by low-privileged users
- Unexpected process execution from Splunk context
- Authentication attempts from unexpected sources
Network Indicators:
- Unusual outbound connections from Splunk servers
- Suspicious API calls to session management endpoints
SIEM Query:
index=_internal source=*web_access.log (status=200 OR status=302) user!=admin user!=power | stats count by user, clientip, uri_path