CVE-2024-45735
📋 TL;DR
This vulnerability allows low-privileged users without admin or power roles to view App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App. This affects Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0.
💻 Affected Systems
- Splunk Enterprise
- Splunk Secure Gateway
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain sensitive cryptographic keys and configuration details, potentially enabling further attacks against the KV Store or related systems.
Likely Case
Unauthorized users gain visibility into sensitive deployment configurations and cryptographic materials, violating the principle of least privilege.
If Mitigated
With proper role-based access controls, only authorized users can access sensitive configuration data.
🎯 Exploit Status
Exploitation requires authenticated low-privileged access to the Splunk interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Splunk Enterprise 9.2.3, 9.1.6; Splunk Secure Gateway on Splunk Cloud Platform 3.4.259, 3.6.17, 3.7.0
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-1005
Restart Required: Yes
Instructions:
1. Download the appropriate patch version from Splunk's website. 2. Backup your Splunk configuration. 3. Apply the patch following Splunk's upgrade documentation. 4. Restart Splunk services.
🔧 Temporary Workarounds
Restrict Access to Splunk Secure Gateway App
allLimit user access to the Splunk Secure Gateway App to only authorized administrators.
🧯 If You Can't Patch
- Review and restrict user roles to minimize access to Splunk Secure Gateway App.
- Monitor audit logs for unauthorized access attempts to sensitive configuration data.
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface or CLI and compare against affected versions.Check Version:
splunk versionVerify Fix Applied:
Verify Splunk version is at or above patched versions and test that low-privileged users cannot access KV Store deployment configuration.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to KV Store configuration endpoints in Splunk audit logs.
SIEM Query:
index=_audit action="access" app="splunk_secure_gateway" user!=admin user!=power | stats count by user, action