Splunk IT Service Intelligence up to 4.13.2/4.15.2 ANSI Escape neutralization for logs

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Splunk IT Service Intelligence up to 4.13.2/4.15.2. This vulnerability affects unknown code of the component ANSI Escape Handler. This manipulation causes neutralization for logs. This vulnerability is handled as CVE-2023-4571. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Splunk IT Service Intelligence up to 4.13.2/4.15.2 (Log Management Software) and classified as problematic. Affected by this vulnerability is an unknown functionality of the component ANSI Escape Handler. The manipulation with an unknown input leads to a neutralization for logs vulnerability. The CWE definition for the vulnerability is CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Splunk IT Service Intelligence (ITSI) versions below 4.13.3 or 4.15.3, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The vulnerability does not directly affect Splunk ITSI. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file. For example, users can copy the malicious file from Splunk ITSI and read it on their local machine.

The weakness was released 08/30/2023 as SVD-2023-0810. It is possible to read the advisory at advisory.splunk.com. This vulnerability is known as CVE-2023-4571 since 08/28/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.13.3 or 4.15.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• IT Service Intelligence

Version

• 4.13.0
• 4.13.1
• 4.13.2
• 4.15.0
• 4.15.1
• 4.15.2

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion