CVE-2024-45739
📋 TL;DR
Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 may log plaintext passwords for local native authentication users when the AdminManager log channel is set to DEBUG level. This affects organizations using Splunk Enterprise with local user authentication and DEBUG logging enabled for AdminManager.
💻 Affected Systems
- Splunk Enterprise
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Attackers with access to log files could harvest plaintext passwords for local Splunk users, potentially gaining administrative access to the Splunk instance and sensitive data.
Likely Case
Internal users or attackers with existing log access could discover passwords, leading to unauthorized Splunk access and potential data exposure.
If Mitigated
With DEBUG logging disabled for AdminManager, passwords remain protected in logs, limiting exposure to standard logging levels.
🎯 Exploit Status
Exploitation requires existing access to Splunk logs or the ability to read log files through other means.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.3.1, 9.2.3, or 9.1.6
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2024-1009
Restart Required: Yes
Instructions:
1. Backup Splunk configuration and data. 2. Download appropriate patched version from Splunk downloads. 3. Stop Splunk services. 4. Install update following Splunk upgrade documentation. 5. Restart Splunk services. 6. Verify version and functionality.
🔧 Temporary Workarounds
Disable DEBUG logging for AdminManager
allChange AdminManager log channel from DEBUG to INFO or higher level to prevent password logging.
Edit $SPLUNK_HOME/etc/log.cfg or use Splunk CLI to modify logging levels
🧯 If You Can't Patch
- Ensure AdminManager log channel is not set to DEBUG level
- Restrict access to Splunk log files to authorized administrators only
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface (Settings > Server Info) or CLI, and verify AdminManager logging level in log.cfg.Check Version:
$SPLUNK_HOME/bin/splunk versionVerify Fix Applied:
Confirm Splunk version is 9.3.1, 9.2.3, or 9.1.6 or higher, and test that passwords are not logged in DEBUG mode.📡 Detection & Monitoring
Log Indicators:
- Plaintext passwords appearing in splunkd.log or other log files
- DEBUG level logging entries containing authentication data
Network Indicators:
- Unauthorized access attempts to Splunk log files
SIEM Query:
index=_internal source=*splunkd.log "password" DEBUG | table _time, host, source, _raw