PT-2023-29657 · Splunk · Splunk It Service Intelligence
Fredrik Alexandersson
·
Publicado
2023-08-30
·
Atualizado
2024-12-10
·
CVE-2023-4571
CVSS v3.1
8.6
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Splunk IT Service Intelligence (ITSI) versions prior to 4.13.3
Splunk IT Service Intelligence (ITSI) versions prior to 4.15.3
Splunk IT Service Intelligence (ITSI) versions prior to 4.17.1
Description
A malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files. When a vulnerable terminal application reads these log files, it can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file.
Recommendations
For versions prior to 4.13.3, update to version 4.13.3 or later.
For versions prior to 4.15.3, update to version 4.15.3 or later.
For versions prior to 4.17.1, update to version 4.17.1 or later.
As a temporary workaround, consider avoiding the use of terminal applications that translate ANSI escape codes to read log files from Splunk ITSI until a patch is applied. Restrict access to log files and limit user interaction with potentially malicious files to minimize the risk of exploitation.
Correção
Improper Encoding or Escaping of Output
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Splunk It Service Intelligence