Splunk Enterprise/Cloud Platform Splunk-to-Splunk certificate host validation

Summaryinfo

A vulnerability has been found in Splunk Enterprise and Cloud Platform and classified as critical. Affected is an unknown function of the component Splunk-to-Splunk Handler. This manipulation causes certificate host validation. This vulnerability is registered as CVE-2022-32153. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Splunk Enterprise and Cloud Platform (Log Management Software) (the affected version unknown) and classified as critical. Affected by this vulnerability is an unknown part of the component Splunk-to-Splunk Handler. The manipulation with an unknown input leads to a certificate host validation vulnerability. The CWE definition for the vulnerability is CWE-297. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.

The weakness was published 06/15/2022. It is possible to read the advisory at docs.splunk.com. This vulnerability is known as CVE-2022-32153 since 05/31/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Cloud Platform
• Enterprise

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion