QID 150747

Splunk Enterprise is a software product that enables you to search, analyze, and visualize the data gathered from the components of your IT infrastructure or business.

Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Affected version:
Splunk Enterprise versions below 9.0.7 and 9.1.2

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request to "config" endpoint and checks the response body to confirm if the host is running vulnerable version of splunk enterprise.

Successful exploitation of the vulnerability may allow a remote attacker to execute arbitrary code.