PT-2022-3396 · Splunk · Universal Forwarder+1

Martin Müller + 2 · Published 2022-06-14 · Updated 2022-06-24 · CVE-2022-32157

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0

Description The issue is related to the lack of an authentication procedure in Splunk Enterprise deployment servers, allowing unauthenticated downloading of forwarder bundles. This can potentially enable a remote attacker to elevate their privileges. Remediation requires updating the deployment server to version 9.0 and configuring authentication for deployment servers and clients. Once enabled, deployment servers can only manage Universal Forwarder versions 9.0 and higher. Although Universal Forwarders are not directly affected, updating them to version 9.0 or higher is necessary prior to enabling the remediation.

Recommendations Update the deployment server to version 9.0. Configure authentication for deployment servers and clients. Update all Universal Forwarders managed by the deployment server to version 9.0 or higher prior to enabling the remediation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-04168

CVE-2022-32157

Affected Products

Splunk Enterprise

Universal Forwarder

References · 10

• https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04168 · Security Note
• https://splunk.com/en_us/product-security/announcements/svd-2022-0607.html · Vendor Advisory
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32157 · Security Note
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32157 · Vendor Advisory
• https://t.me/cibsecurity/44558 · Telegram Post
• https://t.me/true_secator/3066 · Telegram Post
• https://t.me/cvenotify/31662 · Telegram Post