Splunk Vulnerabilities Discovered

Two critical vulnerabilities have been identified in Splunk Enterprise, a software platform for data analysis. Let’s delve into the technical details of each vulnerability and how they can be exploited.

CVE-2024-29946: Risky Command Bypass in Splunk Dashboard Studio

This vulnerability resides within the Splunk Dashboard Studio app, a feature that provides pre-built dashboards for users. The issue stems from inadequate validation of Search Processing Language (SPL) commands within these dashboards. SPL is a query language used to search and analyze data in Splunk. An attacker could exploit this by crafting a malicious SPL query and embedding it within a seemingly legitimate dashboard. A user tricked into initiating this dashboard through their browser could unknowingly trigger the malicious SPL query. Since these queries bypass safeguards meant to prevent risky commands, an attacker could potentially gain unauthorized access to sensitive data or even compromise the entire Splunk system (Splunk, 2024).

CVE-2024-29945: Remote Code Execution via SPL Compiler

The specifics of CVE-2024-29945 are being withheld to prevent attackers from developing exploits (Splunk, 2024). However, it is believed to be a flaw within the SPL compiler, the software component responsible for processing SPL queries. A malicious actor could potentially craft a specially designed SPL query that exploits this vulnerability. Such a query could inject arbitrary code directly onto the Splunk server, allowing the attacker to remotely execute code and potentially gain full control over the system. This could lead to devastating consequences, including deploying malware, stealing data, or launching further attacks within the network.