PT-2023-3015 · Splunk · Splunk Enterprise+1

Try_To_Hack · Published 2023-06-01 · Updated 2024-04-10 · CVE-2023-32707

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100

Description A low-privileged user with the edit user capability can escalate their privileges to that of the admin user by providing specially crafted web requests. The issue is related to authorization procedure weaknesses in the authorize.conf configuration file. This can allow a remote attacker to elevate their privileges.

Recommendations For Splunk Enterprise versions prior to 9.0.5, update to version 9.0.5 or later. For Splunk Enterprise versions prior to 8.2.11, update to version 8.2.11 or later. For Splunk Enterprise versions prior to 8.1.14, update to version 8.1.14 or later. For Splunk Cloud Platform versions prior to 9.0.2303.100, update to version 9.0.2303.100 or later. As a temporary workaround, consider restricting the edit user capability to prevent privilege escalation until a patch is applied.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2023-03078

CVE-2023-32707

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/splunk_privilege_escalation_cve_2023_32707.rb · Exploit
• 🔥 https://exploit-db.com/exploits/51747 · Exploit
• https://bdu.fstec.ru/vul/2023-03078 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32707 · Vendor Advisory
• https://research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593 · Vendor Advisory
• https://advisory.splunk.com/advisories/SVD-2023-0602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32707 · Security Note
• https://t.me/cybersecuritytechnologies/9287 · Telegram Post
• https://t.me/true_secator/4461 · Telegram Post
• https://twitter.com/redwaysec/status/1702030322508919055 · Twitter Post
• https://t.me/cvenotify/51575 · Telegram Post