Splunk 4.3.3 Data Preview privileges management ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Splunk 4.3.3. It has been rated as problematic. The affected element is an unknown function of the component Data Preview. Performing a manipulation results in privileges management. In addition, an exploit is available. It is still unclear if this vulnerability genuinely exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Splunk 4.3.3 (Log Management Software). This affects an unknown function of the component Data Preview. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. Splunk is a software to search, monitor and analyze machine-generated data by applications, systems and IT infrastructure at scale via a web-style interface. Splunk captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.

The bug was discovered 07/27/2012. The weakness was presented 09/04/2012 by Marcio Almeida as EDB-ID: 21053 as confirmed exploit (Exploit-DB). The advisory is shared at exploit-db.com. The public release was coordinated in cooperation with the project team. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue. The advisory describes the business impact as follows: "An authenticated attacker with admin privileges on splunk could exploit the vulnerability to retrieve the contents of any sensitive files in the server accessible by the operating system user the splunk service is running as. If splunkd is running as root user, the attacker can read the content of any file in the server, including /etc/shadow and other sensitive configuration files. Thus, being an admin in the splunk UI allows an attacker to obtain information that may lead to escalation of privileges on the operating system where splunk is installed."

A public exploit has been developed by Marcio Almeida in Text and been published immediately after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 39 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment.

Upgrading to version 4.3.4 eliminates this vulnerability. The upgrade is hosted for download at splunk.com.

The vulnerability is also documented in the databases at Exploit-DB (21053), OSVDB (85824†) and SecurityTracker (ID 1027476†). Further details are available at docs.splunk.com. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Log Management Software

Name

• Splunk

Version

• 4.3.3

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion