QID 379307
Date Published: 2024-02-20
QID 379307: Splunk Enterprise Improper Permissions Handling Vulnerability (SVD-2024-0105)
Splunk software helps capture, index and correlate real-time data in a searchable repository, from which it can generate graphs, reports, alerts, dashboards and visualizations.
Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.
Affected Versions:
Splunk Enterprise versions from 9.0.0 prior to 9.0.8
Splunk Enterprise versions from 9.1.0 prior to 9.1.3
QID Detection Logic (Authenticated)
Linux: Checks for installed vulnerable version of Splunk Enterprise from "/etc/splunk.version" file either in "/opt/splunk" directory or using "$SPLUNK_HOME" environment variable along with splunk web configuration check using "/etc/system/default/limit.conf" or "/etc/system/local/limit.conf".
Windows: Checks for installed vulnerable version of Splunk from "/etc/splunk.version" file using registry "HKLM\SYSTEM\CurrentControlSet\Services\Splunkd".
Note: This QID doesn't check for the available workaround, hence marked potential.
Successful exploitation of this vulnerability results in the deletion of KV Store collections and loosing the Integrity of files and sensitive information
Workaround:
Remove the list_all_objects capability from users that do not require it.
If you are not using KV Store, you can disable it.
- SVD-2024-0105 -
advisory.splunk.com/advisories/SVD-2024-0105
CVEs related to QID 379307
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| SVD-2024-0105 |
advisory.splunk.com/advisories/SVD-2024-0105 |